Named Credentials and External Credentials

// DON'T DO THIS
request.setEndpoint('https://api.example.com/shipping-rates');
request.setHeader('Authorization', 'Bearer sk_live_abc123secretkey'); // a real secret, hardcoded!

1. // DON'T DO THIS — a deliberate anti-pattern, not code to copy.
2. request.setEndpoint('https://api.example.com/shipping-rates'); — a hardcoded URL, at least not secret.
3. request.setHeader('Authorization', 'Bearer sk_live_abc123secretkey'); // a real secret, hardcoded! — a genuine credential, sitting directly in Apex source.

Hardcoding an API key or token directly in Apex code means it's visible to anyone who can read the code, and changing it later (say, rotating a compromised key) requires a full deployment — a real, serious problem this lesson exists to solve.

HttpRequest request = new HttpRequest();
request.setEndpoint('callout:Shipping_API/rates'); // "callout:" + the Named Credential's name
request.setMethod('GET');

HttpResponse response = new Http().send(request);

1. HttpRequest request = new HttpRequest(); — a new request.
2. request.setEndpoint('callout:Shipping_API/rates'); // "callout:" + the Named Credential's name — no secret, no raw URL — just a reference to org configuration.
3. request.setMethod('GET'); — unchanged.
4. (blank line)
5. HttpResponse response = new Http().send(request); — Salesforce resolves the Named Credential and attaches authentication automatically before sending.

callout:Shipping_API refers to a Named Credential configured in Setup — Salesforce automatically attaches the correct authentication (API key, OAuth token, whatever the Named Credential defines) to the request, and Apex code never sees or handles the actual secret at all.

Module 29's custom-metadata deployability lesson applies a related idea here: a Named Credential's endpoint and authentication live as org configuration, changeable by an admin in Setup without touching Apex code or triggering a deployment at all — and critically, the secret itself is never exposed in code that could be viewed, copied, or accidentally committed to version control (Module 14).