IntegrationAdvancedsecretsnamed-credentialssecurity
Secure integration secrets and credential management
Real World Scenario
Developers stored API keys in Custom Labels and Flow hardcoded URLs until leaked in sandbox refresh to contractor org.
Expected Answer
• Named Credentials and External Credentials for all outbound auth
• Secrets in AWS Secrets Manager or Azure Key Vault referenced by middleware
• Never commit secrets to Git; scan repos with trufflehog in CI
• Rotate credentials on schedule with automated deployment pipeline
• Separate credentials per environment isolated in vault paths
• Protected Custom Settings only for non-secret config flags
• Audit trail on Named Credential changes
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Direct answer: Named Credentials and External Credentials for all outbound auth Also consider: Secrets in AWS Secrets Manager or Azure Key Vault referenced by middleware In practice: Never commit secrets to Git; scan repos with trufflehog in CI Optimize for scale and operational observability.
Architect Perspective
Secret sprawl is architectural debt—centralize in vault with rotation or accept breach inevitability.