We are building a simple functionality on a CloudPage that will be making an API call to Marketing Clouds API. I was looking at documentation to find information on where we should store the Client Id and secret, but only found the following:

Store your client ID and secret securely. Never expose this information on the client side via JavaScript or store it in a mobile application.


So where and how should we store it to make sure it’s safe? All suggestions will be appreciated.


Not a bullet proof solution, but I have implemented an increased level of security by using EncryptSymmetric and DecryptSymmetric, so you avoid storing the id and secret directly in Ampscript.

First you create the three required assets in Key Management:

  • Password
  • Salt
  • Initialisation vector

You need to use the EncryptSymmetric in a different Cloud Page to get the encrypted value, which you can use in your integration. This can then be stored in e.g. @APIsecretEncrypted value, without exposing it in clear text. Use same password, salt and initialisation vector to decrypt it:

SET @APIsecret = DecryptSymmetric(@APIsecretEncrypted, "AES", "passwordExternalKey", @null, "saltExternalKey", @null, "IVExternalKey", @null) 

Again, this is by no means high security, as anyone can ask @APIsecret to be printed: %%=V(@APIsecret)=%% hereby exposing it. But it at least gives you additional level of "hiding" it.

  • Thank you - so I hardcode the encrypted values directly in the CloudPage and decrypt them in ampscript before I make the call? – julia2019 Nov 19 '19 at 20:57
  • 1
    Yes, indeed @julia2019 – Lukas Lunow Nov 19 '19 at 23:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.