How to access OAuth Token stored in NamedCredential using Apex for use in other third party application

Question

I'd like to use the native Salesforce Auth. Provider and Named Credential capabilities to allow a Salesforce user to follow the OAuth flow to authenticate against a 3rd party service, and then later query the Named Credential from an ESB system, so that I can use the token stored in Salesforce from within the ESB to access the data in the 3rd party service.

Somethings like this:

Looking at the documentation for NamedCredential, and other posts on SFSE, I get the impression I would not be able to access the token for use elsewhere.

Therefore, I believe (and would like confirmed), that I need to build a completely custom process for handling the OAuth flow, storing the token, refresh token and expiry into Custom Metadata?

Answer 1

Auth.AuthToken.getAccessToken(String authProviderId, String providerName) can get the access token from the auth provider. The call to getAccessToken is made within the currently established security context. That is, if ESB calls Salesforce via whatever API and authorizes this call as user Foo, the call to getAccessToken will retrieve the token for user Foo.

If you roll your own auth provider or your own token acquisition code without an auth provider, the common wisdom is that tokens should be stored in custom settings and/or custom metadata. Platform cache is another option.

We disagree with the common wisdom. Our recommendation is that tokens (and any intermediate material if needed) should be managed as fields on records via a custom object. You can encrypt fields, manage and audit access to these records based on the usual Salesforce machinery. Historical records could be kept for audit purposes, records can be purged, reported on and so on.