Update or Delete an OAuth Named Credential

Here are some examples of how you can update or delete a credential from Apex. These code examples reference and build on the Apex code in Create an OAuth Named Credential which creates a named credential that connects to GitHub.

Update or delete an external auth identity provider
Update or delete an external credential
Update or delete a named credential

For security reasons, if your managed package code (Apex or Metadata API) programmatically updates a named credential, Salesforce automatically disables callouts for that credential. This safety mechanism prevents malicious code from silently redirecting an authenticated connection to an attacker-controlled server.

After your package updates a credential, the connection won’t immediately work. You must instruct the subscriber’s admin to turn on the Enabled for Callouts field in the named credential. See Create or Edit a Named Credential in Salesforce Help.

Example: Update an External Auth Identity Provider

In this example, the auth provider authorization URL is updated.

1// Create external auth identity provider metadata
2ConnectApi.ExternalAuthIdentityProviderInput idpInput = new ConnectApi.ExternalAuthIdentityProviderInput();
3
4String fullName = ‘GitHubProvider’;
5idpInput.fullName = fullName;
6idpInput.label = fullName;
7idpInput.authenticationProtocol = ConnectApi.IdentityProviderAuthProtocol.OAuth;
8idpInput.authenticationFlow = ConnectApi.IdentityProviderAuthFlow.AuthorizationCode;
9// Update the authorization URL
10idpInput.authorizeUrl = 'https://www.test.com/1';
11idpInput.tokenUrl = 'https://www.test.com';
12idpInput.userInfoUrl = 'https://www.test.com';
13
14ConnectApi.ExternalAuthIdentityProvider actualIdp = ConnectApi.NamedCredentials.updateExternalAuthIdentityProvider(fullName, idpInput);

Example: Update an External Credential

In this example, the external credential’s scope for GitHub access is updated to full.

1ConnectApi.ExternalCredentialInput externalCredentialInput = new ConnectApi.ExternalCredentialInput();
2
3externalCredentialInput.developerName = 'GitHubOAuth';
4externalCredentialInput.masterLabel = 'GitHub OAuth';
5externalCredentialInput.authenticationProtocol = ConnectApi.CredentialAuthenticationProtocol.OAuth;
6
7externalCredentialInput.principals = new List<ConnectApi.ExternalCredentialPrincipalInput>();
8externalCredentialInput.parameters = new List<ConnectApi.ExternalCredentialParameterInput>();
9
10// Specify GitHub as the external auth identity provider
11ConnectApi.ExternalCredentialParameterInput authProviderParam = new ConnectApi.ExternalCredentialParameterInput();
12authProviderParam.parameterName = 'GitHubProvider';
13authProviderParam.parameterType = ConnectApi.ExternalCredentialParameterType.ExternalAuthIdentityProvider
14authProviderParam.parameterValue = 'GitHubProvider';
15
16externalCredentialInput.parameters.add(authProviderParam);
17
18// Populate principals to connect the external credential to permissions
19ConnectApi.ExternalCredentialPrincipalInput principalOne = new ConnectApi.ExternalCredentialPrincipalInput();
20principalOne.principalName = 'Developer Access';
21principalOne.principalType = ConnectApi.CredentialPrincipalType.PerUserPrincipal;
22principalOne.sequenceNumber = 1;
23principalOne.parameters = new List<ConnectApi.ExternalCredentialParameterInput>();
24
25// Update the credential-level scope for GitHub access
26ConnectApi.ExternalCredentialParameterInput scopeParam = new ConnectApi.ExternalCredentialParameterInput();
27scopeParam.parameterName = 'Scope';
28scopeParam.parameterType = ConnectApi.ExternalCredentialParameterType.AuthParameter;
29scopeParam.parameterValue = 'full';
30
31principalOne.parameters.add(scopeParam);
32
33ConnectApi.ExternalCredentialPrincipalInput principalTwo = new ConnectApi.ExternalCredentialPrincipalInput();
34principalTwo.principalName = 'Markdown Access';
35principalTwo.principalType = ConnectApi.CredentialPrincipalType.NamedPrincipal;
36principalTwo.sequenceNumber = 2;
37
38externalCredentialInput.principals.add(principalOne);
39externalCredentialInput.principals.add(principalTwo);
40
41ConnectApi.ExternalCredential updatedEC = ConnectApi.NamedCredentials.updateExternalCredential('GitHubOAuth', externalCredentialInput);

Example: Update a Named Credential

In this example, the named credential’s callout URL is updated.

1ConnectApi.NamedCredentialInput namedCredentialInput = new ConnectApi.NamedCredentialInput();
2
3namedCredentialInput.developerName = 'githubAPI';
4namedCredentialInput.masterLabel = 'GitHub API';
5namedCredentialInput.type = ConnectApi.NamedCredentialType.SecuredEndpoint;
6// Update the callout URL
7namedCredentialInput.calloutUrl = ‘https://api.github.com/2';
8
9namedCredentialInput.externalCredentials = new List<ConnectApi.ExternalCredentialInput>();
10ConnectApi.ExternalCredentialInput externalCredential = new ConnectApi.ExternalCredentialInput();
11externalCredential.developerName = 'GitHubOAuth';
12namedCredentialInput.externalCredentials.add(externalCredential);
13
14ConnectApi.NamedCredentialCalloutOptionsInput calloutOptions = new ConnectApi.NamedCredentialCalloutOptionsInput();
15calloutOptions.allowMergeFieldsInBody = false;
16calloutOptions.allowMergeFieldsInHeader = false;
17calloutOptions.generateAuthorizationHeader = true;
18namedCredentialInput.calloutOptions = calloutOptions;
19
20ConnectApi.NamedCredential updatedNamedCredential = ConnectApi.NamedCredentials.updateNamedCredential('githubAPI', namedCredentialInput);

Example: Delete an External Auth Identity Provider

1ConnectApi.NamedCredentials.deleteExternalAuthIdentityProvider('GitHubProvider');

Example: Delete an External Credential

1ConnectApi.NamedCredentials.deleteExternalCredential('GitHubOAuth');

Example: Delete a Named Credential

1ConnectApi.NamedCredentials.deleteNamedCredential('githubAPI');