Can Named Credential merge fields be used in URLs?

Question

You might want to pass dynamic values such as authentication details into the URL for an external service using Named Credentials. However, the issue arises because merge fields like {!$Credential.Password} or {!$Credential.UserName} do not get decoded until the request is actually sent, making it difficult to directly pass these as URL parameters. You’ve tried using the following approaches:

req.setEndpoint('callout:Test_Credential/api/action?id={!$Credential.Password}&account={!$Credential.UserName}');

and

req.setEndpoint('callout:Test_Credential/api/action' + '?id=' + '{!$Credential.Password}' + '&account=' + '{!$Credential.UserName}');

However, neither of these results in the expected behavior because the Named Credential attributes are not merged in the URL string until the HTTP request is executed. This means that you only see the un-merged data when debugging the endpoint or headers.

Answer

1. Named Credentials Merge Fields Limitations:

Named Credentials allow you to use merge fields in the HTTP headers and body (Allow Merge Fields in HTTP Header and Allow Merge Fields in HTTP Body), but merge fields cannot be used in the URL directly. This is why attempting to pass merge fields into the URL (like ?id={!$Credential.Password}) won’t work as intended because the values aren’t resolved until the request is actually sent.

2. Alternative Approach – Use POST with Form Parameters:

Since merge fields can’t be used directly in the URL, you could consider using a POST request where you send the authentication details as part of the request body. You can set the body with application/x-www-form-urlencoded content type. Here’s how you might do it:

req.setEndpoint('callout:Test_Credential/api/action');
req.setMethod('POST');
req.setHeader('Content-Type', 'application/x-www-form-urlencoded');
req.setBody('id={!$Credential.Password}&account={!$Credential.UserName}');

This way, you’re passing the parameters in the body, which can resolve merge fields before sending the request.

3. Security Consideration:

It’s important to note that passing sensitive information, such as usernames and passwords, in the URL is a security risk. Most secure APIs will not accept authentication credentials in the query string due to the possibility of logging sensitive information in server logs. You should review the security policies of the API you’re working with to avoid passing sensitive data in an unsafe manner.

4. Debugging HTTP Requests:

To get a better idea of how the HTTP request is formed, you can use debugging tools such as:

• Postman: A popular tool for testing API requests, allowing you to see exactly what is being sent in the request, including headers, body, and URL.
• RequestBin or HookBin: These tools let you create a public endpoint to capture and inspect incoming HTTP requests.

Summing Up

You cannot directly use Named Credential merge fields as URL parameters in Salesforce because merge fields are only resolved in the request body or headers, not in the URL. To work around this limitation, you can use a POST request and pass the parameters in the body with application/x-www-form-urlencoded content type, where the merge fields will be resolved before the request is sent. It’s important to avoid passing sensitive information like usernames and passwords in the URL, as it poses a security risk. Use debugging tools like Postman or RequestBin to inspect the final HTTP request.

Real-Time Project-Based Salesforce Course to Kick Start Your Career

Our Salesforce Course is designed to provide a comprehensive understanding of the Salesforce platform, equipping you with the essential skills needed to excel in the CRM field. The program covers core modules such as Salesforce Admin, Developer, and AI, integrating both theoretical knowledge and practical experience. Through hands-on exercises and real-world project exposure, you’ll develop the expertise to address complex business challenges with Salesforce solutions. Our experienced instructors ensure you gain valuable technical skills and industry-relevant knowledge to succeed within the Salesforce ecosystem.

In addition to technical proficiency, our Salesforce training in Mumbai offers personalized mentoring, certification support, and interview coaching to boost your career prospects. Participants will benefit from detailed study materials, live project experience, and individualized guidance throughout the course. By the end of the program, you’ll be fully prepared for certification exams and equipped with the problem-solving skills and practical experience that employers seek. Begin your Salesforce journey with us and unlock exciting career opportunities. Enroll for a Free Demo!