I'm preparing a managed package however I would like to store some protected custom settings that the user cannot see (access keys, and the like). I'd like These settings to be populated once the user completes the Oauth flow and authorizes my website to access their Salesforce data.
My question is, if I make the custom settings 'protected', will I still be able to populate the information in a subscriber organization managed package-type context? I'm doing this now by making a POST request with the subscriber's OAuth token to:
/services/data/v20.0/sobjects/MyCustomSetting__c/
Will this work once it's a managed package and deployed? If not, what are the alternatives?