I do have only client Id and client secret to an external webservice, not user name or password. with this client id and client secret, would need to generate an access token which will be valid for an hour. So two questions, what is the best way to store client id and client secret in salesforce, and how to manage the token for an hour.

Appreciate your help. Thanks.


2 Answers 2


You can create an Auth Provider & Named Credential in Salesforce for this requirement. The client ID and secret would be stored in the Auth Provider (along with the Authentication and Token endpoint URLs), so SF would be able use them to get the access token (& refresh token) from the provider. Named Credential will in turn use the Auth Provider and simplify the way you make callouts via apex code. This way you can store and manage the client ID & secret securely in the Auth Provider and not have to worry about managing or passing the token via code to the service endpoints.

There are quite a few different questions in this forum that talk about this, but your question seems to lack certain details (like whether your are connecting to an standard OpenID Connect Authentication provider or other existing providers from Google, Facebook, Amazon etc.); so I'm unable to point you to a specific answered question. You can do a quick search to find out more on this forum.

Standard steps to create an Auth Provider for your requirement (assuming the provider facilitates OpenID connect) are as follows:

  1. Go to Settings > Identity > Auth. providers > New
  2. Select Provider Type as Open ID Connect.
  3. Enter Name & URL Suffix values.
  4. Enter the client ID and secret as the values for Consumer Key & Consumer Secret.
  5. Specify the Authorize Endpoint URL & Token Endpoint URL (obtained from the provider).
  6. Optionally, you may specify Default Scopes value.

Sample screenshot of a simple Auth Provider is given below for your reference:

enter image description here

Create a Named credential:

  1. Go to Settings > Network > Named Credential > New Named Credential
  2. Enter the values for Label & Name.
  3. Specify the provider domain URL as the value for URL.
  4. Under Identity Type, select Per User or Named Principal (based on your requirement).
  5. Specify Authentication Protocol as OAuth 2.0.
  6. Lookup the auth provider created previously as the value for Authentication Provider.
  7. Check the box for Start Authentication Flow on Save and then click Save button.

Sample screenshot of a simple Named Credential is given below for your reference:

enter image description here

Steps given above are for creating a simple auth provider and named credential; you may customize them further based on your requirement and you can explore more about these in the SF developer guides and help articles.

Check out the sample code here about how to use Named Credential as the callout endpoints. When your named credential/ auth provider is authenticated, the access token as well as refresh token are fetched and stored by Salesforce. Whenever you hit the endpoint URLs after the expiration of the access token, SF would use the refresh token and hit the token URL endpoint (specified in auth provider) to a get a new access token. So, you wouldn't have to worry about access token expiration. Note that some providers may not give refresh token or might have additional configuration to be performed for facilitating the refresh of access token. You will need to explore the provider documentation or reach out to them to fix such issues.


There are many different options where either you can create a Custom Setting where you can have Last Updated TimeStamp, Client ID and Client Secret, along with the Endpoints this is what I do for all my integrations.

With this I have a batch class which will refresh the Access Token and update the Valid Till TimeStamp.

Alternatively you can have a Custom Setting along with Named Credentials just in case you need to have additional security over Client ID and Client Secret.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .