3

The third party system that I am trying to connect to has following authentication mechanism:

Step 1: We have been provided with a X-Api-User and X-Api-Secret to be included in header. Other header information is: Accept-Charset: utf-8 and Content-Type: application/json. Once we hit an endpoint(POST call) with this data, we get a "token". Authentication : No Auth.

Step 2: Hit another endpoint with above fetched token included in header along with relevant details in body of request. This returns us the required data.

This token is valid for 30 days.

Questions:

  1. Can I use Named credentials in such a scenario? If so how?
  2. How to handle expiry and refresh of authentication token if we use NC?

I can achieve this with traditional method of storing credentials in Custom Metadata and programmatically checking timestamp to get refreshed token etc. Just want to check if we can use more secure way like Named Credentials in such a scenario.

Improve this question
1
  • 1
    Out of the box - no. The closest you can come to this is rolling a custom auth provider with protocol = oAuth...if your service endpoint can be made to kinda sorta resemble oAuth. In your case the non-NC alternative is probably going to be less effort (dev + maintenance).
    – identigral
    Commented Jun 1, 2021 at 15:21

1 Answer 1

Reset to default
1

Closing this question as there seems to be no way for this using purely NC. As a consolation, one thing we can do is to store the username and password in a Named Credential at least, and for making the step 2 call, we can use the traditional way of storing token in metadata etc. So we have 50% of our authentication information "secure".

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .