Authentication details for a Service Framework integration belong in aService Credential, not in custom site preferences or resource bundles. The credential is specifically designed to hold the external service URL, username, and password required for basic authentication.

Salesforce ' s Service Framework documentation states that the service credential is used for basic authentication. Business Manager ' s Service Credentials configuration stores the endpoint URL and the authentication information associated with the remote service. The Script API representation exposesURL,user, andpasswordproperties from the ServiceCredential object.

Placing usernames in site preferences fragments integration configuration and exposes values through a mechanism not designed for service credentials. Storing an endpoint in a.propertiesfile is similarly inappropriate because properties files are normally used for localized application messages rather than environment-specific connectivity configuration.

Keeping secrets in Service Credentials also allows development, staging, and production environments to maintain different endpoints and credentials without changing cartridge source.

Study Guide reference:B2C Commerce Setup — Service Framework, Service Credentials, authentication, URLs, environment-specific configuration, and external REST services.

===============