We want to move all of our secrets (api keys, endpoints, public/private keys, etc) related to several services to custom setting or to custom metadata, we are not sure what place is better.

These settings are going to be updated using a service rest called from a jenkins pipeline, then both components are valid due to can be updated using apex code.

My main concern is that metadata records are visible in the repository but really easy to get the value using a simple soql. On the other hand custom settings records are not in the repo but maybe more complicated to get....

So, what is your opinion?

closed as primarily opinion-based by Renato Oliveira, Reshma, Pranay Jaiswal, glls, battery.cord Feb 8 at 14:54

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    afaik, Without going the route described by @SantanuBoral, there is no way to protect values from inspection by an authorized user (Sysad) except for Named Credential passwords - these can't be deployed from source either – cropredy Feb 7 at 17:30

You should think of using protected Custom metadata types or protected custom settings for this use case.

For more information, refer Protect Custom Metadata Types and Records

  • in our case we are not using the concept of namespace/manage packages then protected is not valid for us.... – lopez.regalado.fj Feb 7 at 16:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.