I want to get an access token from an external endpoint (HTTP callout to REST API) without hardcoding passwords. The external system expects a request with Oauth 2.0 authentication details provided in the body, like the following:
String body = 'client_id='+EncodingUtil.urlEncode('myClientId','UTF-8'); body += '&client_secret='+EncodingUtil.urlEncode('myClientSecret','UTF-8'); body += '&grant_type='+EncodingUtil.urlEncode('password','UTF-8'); body += '&username='+EncodingUtil.urlEncode('myUsername','UTF-8'); body += '&password='+EncodingUtil.urlEncode('myPassword','UTF-8');
Hardcoded request is successful, but I'd like to use Named Credentials. I can set up an Auth. Provider of type Open ID Connect and provide client_id and client_secret. But there I cannot set parameters like 'username' and 'password' which are needed in order to make a proper request. This makes me wonder if that kind of authentication is possible in SF.
An alternative would be using Custom Settings, but then the credentials would be too easily accessible (and concrete setting cannot be deployed) which is not a good practice.
So my question is: Can I securely authenticate with above credentials using Apex without hardcoding them?