Named Credentials and External Credentials
By the end of this lesson, you'll be able to:
- Explain what a Named Credential is and the problem it solves
- Use a Named Credential as a callout endpoint instead of a hardcoded URL
- Recognize why this keeps authentication details out of Apex code entirely
Prerequisites: "HTTP Callouts: Http, HttpRequest, HttpResponse"
The problem with hardcoded endpoints and credentials
// DON'T DO THIS
request.setEndpoint('https://api.example.com/shipping-rates');
request.setHeader('Authorization', 'Bearer sk_live_abc123secretkey'); // a real secret, hardcoded!Hardcoding an API key or token directly in Apex code means it's visible to anyone who can read the code, and changing it later (say, rotating a compromised key) requires a full deployment — a real, serious problem this lesson exists to solve.
Using a Named Credential instead
HttpRequest request = new HttpRequest();
request.setEndpoint('callout:Shipping_API/rates'); // "callout:" + the Named Credential's name
request.setMethod('GET');
HttpResponse response = new Http().send(request);callout:Shipping_API refers to a Named Credential configured in Setup — Salesforce automatically attaches the correct authentication (API key, OAuth token, whatever the Named Credential defines) to the request, and Apex code never sees or handles the actual secret at all.
Why this matters beyond just convenience
Module 29's custom-metadata deployability lesson applies a related idea here: a Named Credential's endpoint and authentication live as org configuration, changeable by an admin in Setup without touching Apex code or triggering a deployment at all — and critically, the secret itself is never exposed in code that could be viewed, copied, or accidentally committed to version control (Module 14).
Exercise
Rewrite this hardcoded endpoint to use a Named Credential called Payment_Gateway instead.
Show hint
'callout:Payment_Gateway' + the path
Named Credentials and External Credentials Quiz
My Notes
Log in to keep private notes on this lesson.
Questions about this lesson
No questions yet — be the first to ask.
Log in to ask a question about this lesson.
Summary
A Named Credential stores an external system's endpoint URL and authentication details as org configuration, not hardcoded Apex — Module 28's "don't hardcode secrets" instinct, applied to integrations specifically.