I am about to create a salesforce app that eventually will be delivered to appExchange, this app has a setting page that requires the user to enter his token that he uses to consume an external API. My question is: is it ok to store that token in a custom field eg: Token__c in the user Object ?


You'll want to read Secure Coding: Storing Secrets. It is recommended that you use a Custom Setting that is Protected so that the secret cannot be used outside of your app's code. Other alternatives are also possible, so you'll want to check out your options.

Not the answer you're looking for? Browse other questions tagged or ask your own question.