Using a custom authentication endpoint with an external credential

Question

Following scenario:

We need to set up a connection to an external API. This API uses the resource parameter for authentication, so using a legacy named credential is not possible.

However, the new named credential or more specifically the external credential have no option to set an authorization URL.

We have two URLs in this case:

1. the API base URL -> https://api-url-base.com/
2. the authorization endpoint URL -> https://api-url-base.com/account/Authenticate

The named credential needs to run it's authorization against 2) but all callouts need to go to 1) + endpoint.

Is there any way to achieve this with the new named credential system?

With Legacy Named Credentials I got the Auth Provider which has Authorize Endpoint URL and Token Endpoint URL. But no way to define the resource parameter on authentication.

Answer 1

Guess I'll be answering my own question :)

The "trick" is that you need to get the token on your own and use merge fields in the request. (Make sure to activate them for the named credential)

req.setEndpoint('callout:ApiBase/' + 'account/Authenticate');
req.setMethod('POST');
req.setHeader('Content-Type', 'application/x-www-form-urlencoded');
req.setBody('grant_type=client_credentials&client_id={!$Credential.External_Credential_Name.client_id}&client_secret={!$Credential.External_Credential_Name.client_secret}&resource={!$Credential.External_Credential_Name.resource}');

Returns:

{"token_type":"Bearer","expires_in":"3599","ext_expires_in":"3599","expires_on":"1678800966","not_before":"1678797066","resource":"https://the_requested_resource.com/resource","access_token":"access_token"

And then perform any further callouts with the retrieved token. This is not exactly what I'd call an optimal solution, since it still takes away the automated authentication we had in legacy named credentials, but it also allows us to store our credential data safely without the use of custom metadata.