I don't know much about Salesforce, but I've learned a lot these last few months. I was given the assignment to create an app for the Salesforce App Exchange, so that our API would be available inside of Salesforce.
When I first created the app, I put our API key inside of an Apex class. When I submitted the app for security review, this was rejected. I asked for advice on salesforce.stackexchange.com and I was told that sensitive data such as API keys should go into a Protected Custom Setting. Which I did.
So I ended up with code like this:
request.setEndPoint(endpoint); request.setMethod('GET'); request.setHeader('Accept', 'application/json'); request.setHeader('x-api-key', PrivateIncInfo__SameDayConfiguration__c.getOrgDefaults().PrivateIncInfo__xApiKey__c);
In my own developer account, I created a Protected Custom Setting in the hierarchy format, and I entered the value for PrivateIncInfo__xApiKey__c.
When I try to use this from my developer account, everything works.
So then I uploaded my managed package, and I logged out of my normal account. I created a completely new developer account and I installed my managed package. I was hoping the data in PrivateIncInfo__xApiKey__c would be automatically carried over from the account where I uploaded the managed package, but apparently that doesn't work (we want to use one API key for all installs on Salesforce). So in the new account, I apparently need to create a new Custom Setting? Which my app will then read?
How do I get the API key into the installation of my managed package, when it is installed in a new account for some new organization? I'm trying to think of the most convenient way that we can distribute our API key with our managed package. We would like to minimize the amount of work that our customers need to do to install this app.