The synchronous callout, done properly: named credentials for auth, a timeout you chose on purpose, and a mock for the test.
Named credentials or nothing
Endpoint URLs and secrets do not belong in Apex or custom settings. A named credential moves auth to configuration — and survives the sandbox refresh that would have leaked your token.
Design for the timeout
Every callout needs an answer to 'what if this takes 30 seconds?' If the user is waiting on the answer, the honest fix is usually to make the integration asynchronous.
Practice in your org
- Open your Developer Edition org and follow along step by step
- Change one thing at a time and note what happens
- When something breaks, read the error before searching for it