I'd like to use the native Salesforce Auth. Provider and Named Credential capabilities to allow a Salesforce user to follow the OAuth flow to authenticate against a 3rd party service, and then later query the Named Credential from an ESB system, so that I can use the token stored in Salesforce from within the ESB to access the data in the 3rd party service.

Somethings like this:

enter image description here

Looking at the documentation for NamedCredential, and other posts on SFSE, I get the impression I would not be able to access the token for use elsewhere.

Therefore, I believe (and would like confirmed), that I need to build a completely custom process for handling the OAuth flow, storing the token, refresh token and expiry into Custom Metadata?

1 Answer 1


Auth.AuthToken.getAccessToken(String authProviderId, String providerName) can get the access token from the auth provider. The call to getAccessToken is made within the currently established security context. That is, if ESB calls Salesforce via whatever API and authorizes this call as user Foo, the call to getAccessToken will retrieve the token for user Foo.

If you roll your own auth provider or your own token acquisition code without an auth provider, the common wisdom is that tokens should be stored in custom settings and/or custom metadata. Platform cache is another option.

We disagree with the common wisdom. Our recommendation is that tokens (and any intermediate material if needed) should be managed as fields on records via a custom object. You can encrypt fields, manage and audit access to these records based on the usual Salesforce machinery. Historical records could be kept for audit purposes, records can be purged, reported on and so on.

  • Thanks identigral. And if I wanted to get the token via a REST API rather than Apex, is that possible?
    – Robs
    Commented Oct 6, 2020 at 22:17
  • 1
    You could do this by building a custom REST API that would call AuthToken.getAccessToken
    – identigral
    Commented Oct 6, 2020 at 23:06
  • I've posted a follow up question: salesforce.stackexchange.com/questions/321814/…
    – Robs
    Commented Oct 7, 2020 at 21:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .