If you are setting up authentication in Payloads for the first time, this is the right place to start. The goal of this guide is to help you understand what credentials do, when to use each credential type, and how to choose the right approach before moving into method-specific setup guides.

This guide is for Salesforce admins and builders who are configuring integrations in Payloads and need to authenticate outbound requests to external APIs.

In Payloads, credentials are the authentication layer used by payloads when calling external systems. Most APIs are not publicly accessible, so each request usually needs some form of identity or token. You configure that once in a credential record, then reference it from the payloads that need it.

From an integration record, open the Credentials section and click New Credential to choose a type.

Use Basic Authentication when the external system expects a username and password in an Authorization header.

Payloads takes the username and password you provide, encodes them as Base64, and sends them in the correct header format when the payload runs.

For more information, see Basic Authentication

Use Bearer Token when the external system expects access-token-based authentication.

In this model, Payloads can use client credentials and token-refresh details to obtain an access token in the background. That access token is then attached to payload executions for the configured token duration, and refreshed again when it expires.

For more information, see Bearer Token Authentication

Use Certificate when the external system expects certificate-based authentication (for example mutual TLS scenarios).

After uploading and activating the certificate in Salesforce setup, you provide the certificate API name in the credential. Payloads then applies that certificate when constructing outbound requests.

For more information, see Certificate Authentication

Use API Key when the external system expects a static header value such as x-api-key.

Payloads defaults the header name to x-api-key, but you can change it if your API requires a different header name.

For more information, see API Key Authentication

Use Custom when you need flexibility beyond the standard API key layout.

Custom credentials let you send the value either as a header or as a query parameter, so you can match APIs that require non-standard authentication placement.

For more information, see Custom Authentication

Treat this overview as the decision layer. First choose the credential type that matches the target API’s authentication requirement, then move to the dedicated setup guide for that specific method.

Credentials are how Payloads authenticates to external systems. The five supported types are Basic Authentication, Bearer Token, Certificate, API Key, and Custom.

Choosing the right credential type first will make payload setup and troubleshooting much simpler.