Northern Trail Outfitters is creating a distributable Salesforce package. The package needs to call into a Custom Apex REST endpoint in the central…

The most secure and maintainable solution is to use Salesforce's built-in framework for authenticated callouts. The package should include the definition for an Authentication Provider. After installation, the subscriber's security team can create a Named Credential that uses this provider. They will then configure it with the Consumer Key and Consumer Secret from a Connected App in the central org. Apex code within the package can then reference the Named Credential by name, and Salesforce will manage the entire OAuth 2.0 authentication flow, including token storage and refresh, securely and transparently.

A. Contacting Salesforce Support is not required for standard API access or for implementing secure authentication in a managed package.

B. Using an encrypted field is a less secure and less robust method than Named Credentials, as it requires manual credential management and does not handle token refresh.

1. Salesforce Help, "Create an Authentication Provider". This document explains how Auth. Providers can be created and configured, noting they can be included in packages.

2. ISVforce Guide, "Create and Register a Package", Section: "Components Available in Managed Packages". This guide confirms that AuthProvider is a packageable component.

3. Apex Developer Guide, "Authenticated Callouts Using Named Credentials". This section highlights Named Credentials as the recommended best practice, abstracting authentication details from the code.