What are Named Credentials and how do they handle authentication?

Named Credentials store the URL and authentication settings for an external endpoint, preventing credentials from being hardcoded in Apex. In Apex callouts, reference: req.setEndpoint('callout:MyNamedCredential/path'); Authentication protocols supported: Password (Basic Auth), OAuth 2.0 (client credentials, JWT bearer, web server flow), AWS Signature V4, JWT, No Auth. Per-User Named Credentials: Each Salesforce user authenticates individually to the external system. The named credential stores the URL; each user must complete an OAuth flow to store their own token. Ideal for user-context integrations. Per-Org: One shared credential for all users. Authentication secrets are stored securely in Salesforce infrastructure and never exposed to Apex code. Named Credentials automatically handle token refresh for OAuth.