We have a managed package that connects with an external system. As a manual step, we ask users to manually create an auth provider and named credentials.

As part of the new release using ConnectApi named credentials can be created using apex.

Sample github recipe

But to create an Auth Provider we still need to use Rest call using session ID, to get the session ID I am using the vf page and creating the auth provider.


<apex:page >  


class AuthProvider {
    String ProviderType = 'OpenIdConnect';
    String FriendlyName = 'NewNameFri2';
    String DeveloperName = 'DeveloperName2';
    String ConsumerKey = 'consumerKey';
    String ConsumerSecret = 'consumerSecret';
    String AuthorizeUrl = 'https://auth.connect.com';
    String TokenUrl = 'https://auth.xxx.com';
    String DefaultScopes = 'manage:xxx-Scope';
    Boolean OptionsSendAccessTokenInHeader = true;
    Boolean OptionsSendSecretInApis = true;
    Boolean OptionsIsPkceEnabled = true;
HttpRequest req = new HttpRequest();
req.setHeader('Authorization', 'Bearer '+UserInfo.getSessionId());
req.setHeader('Content-Type', 'application/json');
req.setBody(JSON.serialize(new AuthProvider()));
HttpResponse res = new Http().send(req);

So my question is

  1. Am I doing this correctly as ISV (Any problem will come in security review) ?
  2. Is there any way can I create authProvider other than Rest API ?

1 Answer 1


As an ISV you cannot use Session ID for modifying or creating metadata (you can use it for some querying of metadata though). If you do, you will likely fail the security review. I recommend you stick with the manual after-install action at the moment.

If you are not registered for partner collaboration, get registered and take a look at this thread. This is a really long thread covering the pain and various ways to try to work without Session ID.

You can also get some guidance around what you can and cannot do with Session ID from this document, a draft provided by Salesforce (I have not seen a newer version).

You are required to use a connected app and a whole mess of hoops to achieve this. It is a total sh*tshow that Salesforce really need to sort out and simplify.

  • Thanks @phil for your time to reply my question, But what is the use of next gen named credentials for ? youtu.be/2aRUcQ_UTkM please check the video.
    – Ragul
    Commented Mar 7 at 23:25
  • 1
    @Ragul IMHO they are not ready for use in app exchange listed managed packages because of these problems, but regardless, you cannot use Session ID - you will fail security review. This is all captured in the partner forum details I shared.
    – Phil W
    Commented Mar 8 at 6:23
  • Thanks for your reply.
    – Ragul
    Commented Mar 8 at 15:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .