We are using a private key for encryption. At the time of installation, we are generating a random key using Salesforce Crypto class and storing that key in a custom setting.

Admins will be able to view the encryption key in a custom setting. Need a suggestion that should we keep a private key in custom settings or should we keep it as Hard Coded in class?

By keeping as Hard Coded key in Apex, any users will not be able to read private key in managed package class. Can someone suggest their thought on storing private keys in Custom Settings vs Apex Class constants?


1 Answer 1


As you are generating the key at installation time, you will have to store is somehow and a custom setting is a simple way.

If you use a protected custom setting (in your managed package), then it can't be directly accessed through the Setup UI - it can only be accessed from your managed package code. If that is what you want then you are done.

If Privacy for a custom setting is Protected and the custom setting is contained in a managed package, the subscribing organization cannot edit the values or access them using Apex.

If you have a need for it to be viewed/changed by your customers after installation, then you can create a small Visualforce page that provides access and access rights can then be granted via profiles/permission sets.

(If you want to just hard-code it in an Apex class that will work too but then every installation is using the same key. Using the Metadata API to update an Apex class on installation would be overly complicated IMHO.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .