Using per subscriber callout from managed package

Question

I'm creating a managed package that includes a callout to a custom REST API endpoint. Based on this conversation thread, it appears that the "new" External Credentials are not supported for 2GP packaging: Correctly grant access to packaged Named Credentials

The existing code works well in the package org, so I'm hesitant to change the implementation. Instead, I tried to simply create the Named Credential manually in the subscriber org and grant access to it.

Here's the apex I'm using. Note there is no namespace in the Named Credential name:

HttpRequest req = new HttpRequest();        
req.setEndpoint('callout:namedCredentialNameHere'); 

Then I logged onto a demo/subscriber org and manually created the "namedCredentialNameHere" named credential, external credential, and permission set assignment. Then I fired the callout via anonymous apex. Got a 200 response, everything is great right?

Unfortunately, my managed package code doesn't get the same result. When the managed package apex code fires, this exception occurs:

The callout couldn't access the endpoint. You might not have the required permissions, or the named credential "namedCredentialNameHere" might not exist. (managedPackageNameSpaceHere)

Is there any way to have managed package code use a subscriber-defined named credential? Perhaps I should update the apex to target the c__ namespace?

Thanks in advance!

UPDATE: Based on comments, I tried 'callout:c__namedCredentialNameHere'. But I received the same result.

The below link mentioned using '.__' as the prefix. I tried that and it failed as well... https://developer.salesforce.com/forums/?id=906F0000000BIAJIA4

Answer 1

According to the documentation, this isn't supported:

Managed packages can access only the named credentials and external credentials that are included in or created from the package’s Apex code. If a managed package tries to access non-packaged named credentials and external credentials that a Salesforce admin created in the org, an error occurs.

However, as shown in that documentation, you could have your post-install script use the API to create your named and/or external credentials.

UPDATE: Indeed, it seems that there are now other ways to enable use of "manually created" named credentials (essentially subscriber-created named credentials) by a managed package, as explained by Matt and Neil. The above documentation is still in place but seems inconsistent with the ability to make a named credential accessible by a given namespace (and thus one or more managed packages in that namespace).

Answer 2

It may help to differentiate between 'manually created' credentials and Connect API:

• Manual "Legacy" Named Credentials are accessible by all Apex code. If this changes, Salesforce risks breaking many package installs in production.

• Manual Named Credentials (Type = Secured Endpoint) are accessible by Apex specified in the Managed Package Access field. The subscriber enters your Namespace Prefix.

• Automatic ConnectApi.NamedCredential is for deploying credentials via managed Apex. The credential is constrained to the package that invoked the API to create it, right?

Highlighted here is the field a subscriber may populate, to permit a package to make callouts:

Named Credentials documentation: https://developer.salesforce.com/docs/platform/named-credentials/guide/nc-package-credentials.html

Named credentials aren’t automatically added to packages. If you package an external data source or Apex code that specifies a named credential as a callout endpoint, add the named credential to the package. Alternatively, make sure that the subscriber org has a valid named credential with the same name.

• For managed packages, the subscriber must add the package’s namespace to a named credential’s list of allowed namespaces to enable callouts. This action isn’t necessary if the named credential is installed as part of the same package.