HTTP Action authentication with named credentials
How an Integration Procedure HTTP Action authenticates and reaches an endpoint: named and external credentials, choosing the protocol and principal type, permission-set access, same-name credentials per environment, Remote Site Settings, Private Connect, client certificates, packaging and when to use a Remote Action instead.
Provide guidance at a high level on the configuration and management of HTTP Actions within an IP to securely connect to and process data from external REST/SOAP endpoints, including authentication and request/response mapping.
~8 min read · 13 practice questions ·
What the exam expects
- Recommend a named credential backed by an external credential for HTTP Action authentication, instead of secrets in headers, bodies or custom settings.
- Match protocol and identity type to the remote system: OAuth 2.0 client credentials or browser flow, JWT Bearer, Basic, AWS Signature Version 4, or Custom headers for API keys.
- Plan user access to a credential and endpoints that differ by environment.
- Recognise when a call needs a Remote Site Setting, Private Connect, a client certificate or a Remote Action, and what to recreate when a credential is packaged.
Key terms: named credential (one definition holding a callout endpoint URL and its authentication); external credential (how Salesforce authenticates to the remote system, through a protocol); principal (the identity a callout uses, linked to permission sets or profiles); Named Principal / Per User (one shared credential for all users, or each user's own); Remote Site Setting (lets Salesforce call a host; holds no credentials).
Key facts
- Detail
- Use Named Credentials; avoid hardcoding sensitive data in headers
- Detail
- Identity type must be Named Principal
- Detail
- Named Principal only; API key stored encrypted on the principal
- Detail
- Principal mapped to the user's permission set or profile, plus User External Credentials access
- Detail
- Same named credential name, different URL in each org
- Detail
- Add the host as a Remote Site first
- Detail
- Supported since Summer '24 through named credentials to AWS
- Detail
- Recreate the signing certificate in the subscriber org before install
- Detail
- Only getBody() is supported; use a Remote Action
Sources for this section (8)
- HTTP Action for Integration Procedureshelp.salesforce.com (opens in a new tab)
- Authentication Protocolshelp.salesforce.com (opens in a new tab)
- Use API Keys in Custom Headershelp.salesforce.com (opens in a new tab)
- Create Named Credentials and External Credentialshelp.salesforce.com (opens in a new tab)
- Named Credentials as Callout Endpointsdeveloper.salesforce.com (opens in a new tab)
- Add NASA as a Remote Sitehelp.salesforce.com (opens in a new tab)
- Private Connecthelp.salesforce.com (opens in a new tab)
- Integration Procedure Actionshelp.salesforce.com (opens in a new tab)
- Why does a callout that works for its admin builder fail for business users?
- When does an HTTP Action need a Remote Site Setting?
- Why should a partner recreate a certificate before installing a package with a JWT Bearer Flow named credential?
- Which protocol fits a service that authenticates with a static key in its own header?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Omnistudio Consultant pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 31 lessons of the Omnistudio Consultant guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (13 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams