Remote Site Settings

💬 In plain words: Think of these as two completely separate security allow-lists that guard different doors. Remote Site Settings give your Salesforce backend server (Apex or Flow HTTP Callout) permission to call an external URL. CSP Trusted Sites (now grouped under Trusted URLs in Salesforce Setup) give the user's web browser (LWC or Aura) permission to fetch data, images, or scripts from an external URL. If an Apex callout fails, check Remote Site Settings or Named Credentials . If a browser request fails inside an LWC, check your CSP Trusted Sites! 📌 Real-Life Example: Imagine you are building a live weather dashboard on an Account page. First, your Apex class tries to fetch weather data from https://api.weather.com , and Salesforce immediately throws a System.CalloutException: Unauthorized endpoint error. Why? Because the Salesforce server blocked the call. The fix is adding a Remote Site Setting (or better yet, a Named Credential). Later tha...