The Security.stripInaccessible method returns the list of SObject. Once you insert this list, it should have the IDs as well.
List<Account> newAccounts = new List<Account>();
Account a = new Account(Name='Acme Corporation 1');
Account b = new Account(Name='Blaze Comics 1');
I ran into two things while trying to resolve this:
The Apex API version needs to be 35 or above (winter '16). That's when support for the merge fields started.
If you have a post request that includes the merge fields in the body then the headers should be set after request.setBody() is called. If you call setHeaders() before setBody() then the merge ...
This is documented in the Winter 21 release notes here
This was a critical update in the last release itself but customers had option to skip its activation.
In the winter 21 release this security feature is auto enforced.
Your sandbox is on Winter 21 I believe and hence you see this change in effect while your PROD is still in Summer 20.
I suggest you have ...
All processing of secrets and authorization using credentials to which the end user is not privy must be done on the server side using Apex. As a managed package, you should ensure that those values are ...
SandboxPostCopy Interface will meet the need. Select it to run when you refresh and it allows you to run a script before activation of the sandbox. There's some limitations (ex. Can't make callouts to update those that need that) but you can do what you need here with updating custom settings.
If you have test servers, you could store that URL to update ...