Guidelines for Authenticating HTTP Callout Actions

Permission Set

Required. Grants users access to make the callout.

If no permission set exists, create one. Add the external credential to the permission set. Then assign the permission set to each user who can make the callout. Alternatively, consider creating a legacy named credential to save time because it doesn’t require a permission set. For more information, see Create a Permission Set for External Credential Principal Access.

Auth. Provider

Required only for the OAuth protocol use cases. The auth provider interacts with the identity provider to obtain tokens.

External Credential

Required. Defines the authentication protocol and credentials.

Create the external credential from the Named Credential Setup page, on the External Credential tab.

Select the appropriate protocol based on the API’s authentication requirements:

• Custom. Select for:
  • Basic authentication (username and password)
  • Key or token
  • No authentication
• OAuth 2.0
• AWS Signature Version 4

Add a Permission Set Mapping to the external credential and select the related permission set.

For APIs that require a key or token in the header:

• Add an Authentication Parameter to the Permission Set Mapping. Enter a unique Name and the key in the Value field.
• Add a Custom Header. Enter the exact Name that the API expects. For the Value, reference the Authentication Parameter name. For example:

  $Credential.namedCredApiName.authParameterName

For APIs that require basic authentication (username and password):

• Add an Authentication Parameter to the Permission Set Mapping to define and store the value of the username.
• To define and store the value of the password, add another Authentication Parameter.
• Add a Custom Header. Enter Authorization as the Name. For the value, reference the username and password Authentication Parameters. For example:

  {!'Basic ' & BASE64ENCODE(BLOB($Credential.BasicAuth.Username & ':' & $Credential.BasicAuth.Password))}

After you’ve created an external credential, create principals for it. These principals are mapped to permission sets and profiles. For more information on creating a principal, see Create or Edit an External Credential.

Named Credential

Required. Defines the name and URL of the endpoint. The named credential is associated with the HTTP callout action when you create the action in Flow Builder.

The external credential and named credential are separate because APIs often have multiple endpoints that are addressed with the same authentication, for example, calendar.google.com/api and drive.google.com/api.

Enter a label that describes the endpoint you’re connecting to, enter the base URL in the URL field, and select the External Credential from the previous step.

For the Generate Authorization Header field, select this option for no-authentication and OAuth use cases. Clear it for key/token and basic authentication (username and password) use cases.

For the Allow Formulas in the HTTP Header field, select this option if the header contains a formula, which applies to basic authentication use cases.

For APIs that require a key or token in the header, add a Custom Header. Enter the exact Name that the API expects. For the Value, reference the Authentication Parameter name. Set the sequence number if a user belongs to multiple permission sets across multiple principals. For more information, see Use Custom Headers with Credentials.

Access to User Credentials Object

Required for all use cases except Open APIs that don’t require authentication. The Named Credentials subsystem stores secret tokens or values in the User Credentials object.

Using Permission Sets or Profiles, grant the required access (Read, Create, Edit, Delete) to the User Credentials Object.