Managed Package app connects to an external REST API. This API uses OAuth2. For easy connectivity, I planned on packaging a custom
AuthProvider with all the app-specific settings like URLs and Client Id and Secret and then have a
NamedCredential that is using it.
The problem I face is that I cannot package an AuthProvider, only a NamedCredential.
As a workaround, I create the
NamedCredential from an Admin-controlled Setup page using
Metadata API. But by doing that the customer Admin sees the Client Id and Secret and could potentially misuse it to talk to the API using my Client Id.
Why doesn't Salesforce allow us to package AuthProviders? At least the org-unspecific parts.
Note: I understand that read-only properties like URLs are org-specific but Salesforce could easily build
AuthProviders to make that dynamic and only contain org independent info.