# HTTP Action authentication with named credentials

*Omnistudio Consultant Study Guide · Integration Procedures · Last updated October 27, 2026 · https://www.certifyforce.com/study-guide/omnistudio-consultant/integration-procedures/http-action-authentication-with-named-credentials*

How an Integration Procedure HTTP Action authenticates and reaches an endpoint: named and external credentials, choosing the protocol and principal type, permission-set access, same-name credentials per environment, Remote Site Settings, Private Connect, client certificates, packaging and when to use a Remote Action instead.

- Certification: Salesforce Omnistudio Consultant
- Exam section: Integration Procedures
- Study guide: https://www.certifyforce.com/study-guide/omnistudio-consultant

**Official exam objective:**

> Provide guidance at a high level on the configuration and management of HTTP Actions within an IP to securely connect to and process data from external REST/SOAP endpoints, including authentication and request/response mapping.

## What the exam expects

- Recommend a named credential backed by an external credential for HTTP Action authentication, instead of secrets in headers, bodies or custom settings.
- Match protocol and identity type to the remote system: OAuth 2.0 client credentials or browser flow, JWT Bearer, Basic, AWS Signature Version 4, or Custom headers for API keys.
- Plan user access to a credential and endpoints that differ by environment.
- Recognise when a call needs a Remote Site Setting, Private Connect, a client certificate or a Remote Action, and what to recreate when a credential is packaged.

Key terms: **named credential** (one definition holding a callout endpoint URL and its authentication); **external credential** (how Salesforce authenticates to the remote system, through a protocol); **principal** (the identity a callout uses, linked to permission sets or profiles); **Named Principal / Per User** (one shared credential for all users, or each user's own); **Remote Site Setting** (lets Salesforce call a host; holds no credentials).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Authentication data | Use Named Credentials; avoid hardcoding sensitive data in headers | [HTTP Action for Integration Procedures](https://help.salesforce.com/s/articleView?id=xcloud.os_http_action_for_integration_procedures_53002.htm&language=en_US&type=5) |
| AWS Signature Version 4 | Identity type must be Named Principal | [Authentication Protocols](https://help.salesforce.com/s/articleView?id=xcloud.nc_auth_protocols.htm&language=en_US&type=5) |
| Custom protocol | Named Principal only; API key stored encrypted on the principal | [Use API Keys in Custom Headers](https://help.salesforce.com/s/articleView?id=xcloud.nc_custom_headers_and_api_keys.htm&type=5) |
| Callout access | Principal mapped to the user's permission set or profile, plus User External Credentials access | [Create Named Credentials and External Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_named_creds_and_ext_creds.htm&language=en_US&type=5) |
| Environment endpoints | Same named credential name, different URL in each org | [Named Credentials as Callout Endpoints](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_named_credentials.htm) |
| Direct URL call | Add the host as a Remote Site first | [Add NASA as a Remote Site](https://help.salesforce.com/s/articleView?id=xcloud.os_add_nasa_as_a_remote_site_53133.htm&language=en_US&type=5) |
| Private Connect | Supported since Summer '24 through named credentials to AWS | [HTTP Action for Integration Procedures](https://help.salesforce.com/s/articleView?id=xcloud.os_http_action_for_integration_procedures_53002.htm&language=en_US&type=5), [Private Connect](https://help.salesforce.com/s/articleView?id=xcloud.private_connect_overview.htm&type=5) |
| Packaged JWT credential | Recreate the signing certificate in the subscriber org before install | [Authentication Protocols](https://help.salesforce.com/s/articleView?id=xcloud.nc_auth_protocols.htm&language=en_US&type=5) |
| Binary responses | Only getBody() is supported; use a Remote Action | [Integration Procedure Actions](https://help.salesforce.com/s/articleView?language=en_US&id=xcloud.os_integration_procedure_actions_50165.htm&type=5) |

## Check yourself

- Why does a callout that works for its admin builder fail for business users?
- When does an HTTP Action need a Remote Site Setting?
- Why should a partner recreate a certificate before installing a package with a JWT Bearer Flow named credential?
- Which protocol fits a service that authenticates with a static key in its own header?

## Sources

- [HTTP Action for Integration Procedures](https://help.salesforce.com/s/articleView?id=xcloud.os_http_action_for_integration_procedures_53002.htm&language=en_US&type=5)
- [Authentication Protocols for Named Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_auth_protocols.htm&language=en_US&type=5)
- [Create Named Credentials and External Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_named_creds_and_ext_creds.htm&language=en_US&type=5)
- [Named Credentials](https://help.salesforce.com/s/articleView?id=xcloud.named_credentials_about.htm&language=en_US&type=5)
- [Named Credentials as Callout Endpoints](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_named_credentials.htm)
- [Use API Keys in Custom Headers with Named Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_custom_headers_and_api_keys.htm&type=5)
- [Named Credential Example: OAuth 2.0 Browser Flow with a Per User Principal](https://help.salesforce.com/s/articleView?id=xcloud.nc_example_oauth_github_per_user.htm&type=5)
- [Secure Cross-Cloud Integrations with Private Connect](https://help.salesforce.com/s/articleView?id=xcloud.private_connect_overview.htm&type=5)
- [Add NASA as a Remote Site](https://help.salesforce.com/s/articleView?id=xcloud.os_add_nasa_as_a_remote_site_53133.htm&language=en_US&type=5)
- [Create the Integration Procedure with the HTTP Action](https://help.salesforce.com/s/articleView?id=sf.os_create_the_integration_procedure_with_the_http_action_53207.htm&language=en_US&type=5)
- [INVALID_SESSION_ID in Omnistudio Integration Procedure](https://help.salesforce.com/s/articleView?id=000394471&language=en_US&type=1)
- [Calling Web Services with the Omniscripts HTTP Action](https://help.salesforce.com/s/articleView?id=sf.os_http_action_12374.htm&language=en_US&type=5)
- [SOAP Services: Defining a Class from a WSDL Document](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_wsdl2apex.htm)
- [Integration Procedure Actions](https://help.salesforce.com/s/articleView?language=en_US&id=xcloud.os_integration_procedure_actions_50165.htm&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 13 linked practice questions, and unlimited timed mock exams are included with the Omnistudio Consultant pack (USD $19): https://www.certifyforce.com/practice-exams