2

I am building an integration between Salesforce and other application with REST API calls. The Salesforce will be consuming data from that other app on in interval. I am writing my code and it is executing how expected, but I do currently have username and password hard-coded. What is the best way to store credentials in Salesforce so I can easily access them in my code?

My first reaction is to use a list type custom setting (because the user name and password is the same for all the users). Any other, more secure ways of doing that?

Improve this question
1

1 Answer 1

Reset to default
4

Yes, you should use NamedCredential to store authentication details. It is significantly more secure than Custom Settings. No one in the system can view a password once saved to this object; this value can only be written to, not read.

See also Named Credentials as Callout Endpoints:

Named Credentials as Callout Endpoints A named credential specifies the URL of a callout endpoint and its required authentication parameters in one definition. Salesforce manages all authentication for Apex callouts that specify a named credential as the callout endpoint so that your code doesn’t have to. You can also skip remote site settings, which are otherwise required for callouts to external sites, for the site defined in the named credential.

By separating the endpoint URL and authentication from the callout definition, named credentials make callouts easier to maintain. For example, if an endpoint URL changes, you update only the named credential. All callouts that reference the named credential simply continue to work.

Improve this answer
2
  • The issue with Named Credentials is that for my purpose authentication needs to be a digest. So I am actively using username and password as a part of my code to get a response string, that I later pass into an Authentication header. //HA1=MD5(username:realm:password) Blob targetBlob = Blob.valueOf('username:realm:pass'); Blob h1 = Crypto.generateDigest('MD5', targetBlob); String h1str = EncodingUtil.convertToHex(h1); System.debug('HA1 ' + h1str); @adrian
    – Art S
    Jan 10, 2019 at 19:08
  • Do you control the endpoint at all? A much more common authentication scheme, which is supported by Named Credential merge fields, is Base-64 encoded username and password.
    – Adrian Larson ♦
    Jan 15, 2019 at 17:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.