Basic authentication in a URL (https://user:password@host/...) is the wrong tool: browsers strip it, servers log it, and it ends up in the process history. Encode the credentials into the Authorization header instead, and keep them out of the process app:
// server-side script: Basic auth header from environment variables (never literals in the script)
var creds = tw.env.partnerUser + ":" + tw.env.partnerPassword;
var header = "Basic " + String(java.util.Base64.getEncoder().encodeToString(new java.lang.String(creds).getBytes("UTF-8")));
var con = new java.net.URL(tw.env.partnerUrl + "/api/orders").openConnection();
con.setRequestProperty("Authorization", header);
// URL-encoding when a credential must go into a query string (API keys, tokens - not passwords)
var url = tw.env.partnerUrl + "/api/orders?apiKey=" + encodeURIComponent(tw.env.partnerApiKey);
// Java equivalent: java.net.URLEncoder.encode(value, "UTF-8")Better than either: a Server definition (Process App Settings > Servers, type REST or Web service) with the user / password stored encrypted in the BPM database and set per environment in Process Admin - the REST external service and web service integrations send the header for you and nothing appears in scripts or logs. For OAuth 2 APIs, a "Get token" service that exchanges client credentials for a bearer token (cached in a variable or an EPV with expiry) and passes Authorization: Bearer …. On CP4BA credentials belong in Kubernetes secrets exposed to Java integrations as environment variables, or in the Server definition as before.
Encoding reminder: encodeURIComponent for query values (spaces, &, =, +), Base64 for the Basic header, never both on the same value.
References