0

Problem

I have a straightforward REST API callout in apex.

request.setEndpoint('https://api.websitename.com');
request.setMethod('GET');
request.setHeader('Authorization','Bearer abcdefghijklmnopqrstuvwxyz');
HttpResponse response = http.send(request);

However, I naturally do not want to hardcode the bearer token, and am looking for ways to securely store it in Salesforce. Multiple sources I've looked at (here, here, and here) suggest using Named Credentials. However, everything I've seen regarding Named Credentials seems to indicate that it is a solution for much more complex integrations than what I am trying to do. The JWT and OAuth authentication options include numerous fields I'm not familiar with at this time, and seem to be more based around creating an ongoing app than handling a simple callout.

This question/answer is very similar to mine, but the accepted (and only) answer suggests storing the bearer token in a custom object, which as mentioned in this question seems like an unideal solution. Custom Settings or Custom Metadata Types are both options as well, but don't seem to be designed with security in mind.

Question

Does securely storing just a bearer token in Salesforce merit using Named Credentials? If so, can one be configured in a way that only references the bearer token? If not, what are secure alternatives?

Edit

In case it is relevant, the API I am referencing is for the GetFeedback online survey platform, documentation here and here.

1
  • Pretty sure for bearer token hardcoded like this you're out of luck. If you control the API, you can switch to Username/Password (Basic auth) and then THOSE you can just store values of in Named Credentials.
    – zaitsman
    Aug 5 '21 at 0:21
1

If possible, you should use Named Credentials with OAuth flow. There will be a one-time manual setup where you have to log in to the third-party OAuth server, but with a refresh token, it will automatically maintain an active session for you, even refreshing the access token if it expires. It's a very hands-off approach to authentication, and works well in most cases. A JWT is similar, but uses a token calculated with a different tool. It's also typically very serviceable. Finally, if the token fits in the password field, you can also cheat with my custom API key solution. Since you've already rejected most of my previous answers, perhaps that's the one that will get you across the finish line.

2
  • I wasn't meaning to reject your answers, I'm just not very knowledgeable on this subject and was trying to figure out how to solve my specific situation. I don't currently know how to set up a session with a third-party OAuth server to connect to the API I'm accessing. However, I was able to get your custom API key solution to work. Thanks for your support!
    – Jwok
    Aug 5 '21 at 17:29
  • @Jwok The OAuth solution has you put in the OAuth token endpoint, then you start a flow in the browser. It's actually pretty straightforward, but if my other solution worked, that's good enough. Glad I could help!
    – sfdcfox
    Aug 5 '21 at 17:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.