I'm creating a managed package that includes a callout to a custom REST API endpoint. Based on this conversation thread, it appears that the "new" External Credentials are not supported for 2GP packaging: Correctly grant access to packaged Named Credentials

The existing code works well in the package org, so I'm hesitant to change the implementation. Instead, I tried to simply create the Named Credential manually in the subscriber org and grant access to it.

Here's the apex I'm using. Note there is no namespace in the Named Credential name:

HttpRequest req = new HttpRequest();        

Then I logged onto a demo/subscriber org and manually created the "namedCredentialNameHere" named credential, external credential, and permission set assignment. Then I fired the callout via anonymous apex. Got a 200 response, everything is great right?

Unfortunately, my managed package code doesn't get the same result. When the managed package apex code fires, this exception occurs:

The callout couldn't access the endpoint. You might not have the required permissions, or the named credential "namedCredentialNameHere" might not exist. (managedPackageNameSpaceHere)

Is there any way to have managed package code use a subscriber-defined named credential? Perhaps I should update the apex to target the c__ namespace?

Thanks in advance!

UPDATE: Based on comments, I tried 'callout:c__namedCredentialNameHere'. But I received the same result.

The below link mentioned using '.__' as the prefix. I tried that and it failed as well... https://developer.salesforce.com/forums/?id=906F0000000BIAJIA4

  • 1
    I'd give the "c__" prefix a shot to see how it behaves though I suspect it probably won't work (the "c" no-namespace prefix isn't recognized in many places, which is quite annoying TBH).
    – Phil W
    Dec 1, 2023 at 13:43
  • Did you find a solution?
    – Phil W
    Jan 3 at 15:59
  • I did not find any solution. And the recently linked documentation indicates that no solution is forthcoming.
    – JimG
    Jan 5 at 18:05

2 Answers 2


According to the documentation, this isn't supported:

Managed packages can access only the named credentials and external credentials that are included in or created from the package’s Apex code. If a managed package tries to access non-packaged named credentials and external credentials that a Salesforce admin created in the org, an error occurs.

However, as shown in that documentation, you could have your post-install script use the API to create your external credentials and/or external credentials.

  • Agreed. I'll mark this solved. Thanks so much for your input.
    – JimG
    Jan 5 at 18:06

It may help to differentiate between 'manually created' credentials and Connect API:

  • Manual "Legacy" Named Credentials are accessible by all Apex code. If this changes, Salesforce risks breaking many package installs in production.

  • Manual Named Credentials (Type = Secured Endpoint) are accessible by Apex specified in the Managed Package Access field. The subscriber enters your Namespace Prefix.

  • Automatic ConnectApi.NamedCredential is for deploying credentials via managed Apex. The credential is constrained to the package that invoked the API to create it, right?

Highlighted here is the field a subscriber may populate, to permit a package to make callouts:


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .