What is the best practice to make an authorised HTTP(s) callout from a Managed Package, i.e. how to handle the credentials safely? So my managed package should call an external webservice, which requires credentials for authentication.
I would expect the following from the solution:
- store credentials in the target org safely
- users in the target org have no access to the credentials
- ISV has the ability to change the credentials when necessary
Is this possible?