We are building a simple functionality on a CloudPage that will be making an API call to Marketing Clouds API. I was looking at documentation to find information on where we should store the Client Id and secret, but only found the following:

Store your client ID and secret securely. Never expose this information on the client side via JavaScript or store it in a mobile application.


So where and how should we store it to make sure it’s safe? All suggestions will be appreciated.


1 Answer 1


Not a bullet proof solution, but I have implemented an increased level of security by using EncryptSymmetric and DecryptSymmetric, so you avoid storing the id and secret directly in Ampscript.

First you create the three required assets in Key Management:

  • Password
  • Salt
  • Initialisation vector

You need to use the EncryptSymmetric in a different Cloud Page to get the encrypted value, which you can use in your integration. This can then be stored in e.g. @APIsecretEncrypted value, without exposing it in clear text. Use same password, salt and initialisation vector to decrypt it:

SET @APIsecret = DecryptSymmetric(@APIsecretEncrypted, "AES", "passwordExternalKey", @null, "saltExternalKey", @null, "IVExternalKey", @null) 

Again, this is by no means high security, as anyone can ask @APIsecret to be printed: %%=V(@APIsecret)=%% hereby exposing it. But it at least gives you additional level of "hiding" it.

  • Thank you - so I hardcode the encrypted values directly in the CloudPage and decrypt them in ampscript before I make the call?
    – julia2019
    Nov 19, 2019 at 20:57
  • 1
    Yes, indeed @julia2019 Nov 19, 2019 at 23:10
  • @LukasLunow, what do you mean by "anyone can ask APIsecret to be printed" ? AmpScript runs server side, so to print a variable one mist have access to edit the Cloud page, or what am I missing?
    – LimeWeb
    Jun 24, 2021 at 6:23
  • @LimeWeb you are correct. You do need edit access to change your Ampscript and show the values. My point is, that anyone with access to MC can potentially use this method to familiarise himself with the credentials, making unauthorised use of the secured resource possible outside of SFMC. Jun 24, 2021 at 6:28
  • Also, @LukasLunow what about the option to either use field level encryption to store the encrypted password in a DE? Would that work? Or encrypt it manually and store the encrypted value? Then let AmpScript read the DE and decrypt as you describe. If this is possible it's still not bulletproof, but seems as secure as your suggestion, so putting alternatives out there. Thoughts? Eventually store the DE in another BU different from the Ampscript Cloudpage
    – LimeWeb
    Jun 24, 2021 at 6:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .