2

I'm looking for Best Practice how to store API Keys like Firebase in Salesforce.

Situation

  • For a Salesforce implementation data has to be pushed to Googles Firebase
  • The API Key should not be visible for the user, developer or administrator
  • We are not building an ISV / AppExchange Application. Therefore, the solution provided here is not applicable: Securely Storing a static API secret/key in a Salesforce app

Question

  • What is the best way to store API Keys in Salesforce?
  • Can I use Named credentials? There is no type called API key?
Improve this question

1 Answer 1

Reset to default
2

For non ISVs

After some research I came to the conclusion that there is only a single place where API Tokens should be stored: Named Credentials. I summarized my findings here: Secure API Keys in Salesforce — Example: Google Firebase

In Named Credentials there is no type called "API Key". However, API Keys are pretty much the same as Passwords, therefore it can be stored as a password.

The API Token can be then used in as a merge field in the header of the request.

ISVs

Named Credentials are at least visible to the user. Therefore, they are not good choice in an ISV context. There it makes more sense to use encrypted fields.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .