Named Credentials and External Credentials
By the end of this lesson, you'll be able to:
- Explain the risk of hardcoding endpoints and secrets directly in Apex
- Use a Named Credential to reference an external endpoint and authentication securely
- Understand External Credentials as the separated, modern authentication model
Prerequisites: "LWC → Apex → REST API Architecture"
The Problem Named Credentials Solve
Hardcoding an endpoint URL or an API key directly in Apex is both a maintenance problem — a URL change requires a code deployment — and a genuine secret-exposure risk: a hardcoded key sits in source code, visible to anyone with read access to the codebase, including in version control history.
Named Credentials
HttpRequest request = new HttpRequest();
request.setEndpoint('callout:Weather_API/current');
request.setMethod('GET');A Named Credential, configured once in Setup, bundles both the endpoint and its authentication — referenced in a callout by name (callout:Weather_API/...) rather than hardcoding either value directly. The actual URL and credentials never appear in Apex source code at all.
External Credentials
The newer, more flexible model splits authentication into two separate pieces: an External Credential defines who is authenticating (the actual auth parameters), while the Named Credential defines where the request goes (the endpoint) and references the External Credential for authentication. This separation is especially useful when several different Named Credentials — pointing at different endpoints — need to share the same underlying authentication.
Why This Matters in Real Projects
A real API key or secret should genuinely never appear directly in Apex source code — Named and External Credentials are the platform-supported way to avoid that entirely, keeping secrets managed declaratively in Setup rather than embedded in deployable code.
Exercise
Rewrite this hardcoded callout to use a Named Credential named "Inventory_API" instead.
Show hint
Use the callout:<NamedCredential> URL scheme.
Exercise
Challenge: explain, as a comment, why hardcoding an API key directly in an Apex class is a real security risk, even in a private org.
Show hint
Think about who has read access to Apex source code, and where it might end up over time.
Named Credentials and External Credentials Quiz
My Notes
Log in to keep private notes on this lesson.
Questions about this lesson
No questions yet — be the first to ask.
Log in to ask a question about this lesson.
Summary
Named Credentials keep an integration's endpoint and authentication out of Apex source code entirely — a real secret should never be visible to anyone with read access to the codebase.