1

It's the {current_year}. How does Salesforce suggest storing API keys when they are used outside callout context (solved very well using Named Credentials)?

Looking at previous discussion, "protected" custom settings are of no use, unless you go thru mess of creating unmanaged package.

My use case is validating request body signature for which I have to store a key somewhere.

Improve this question
4
  • The usual definition of API key is "authorization to call an API". Usually signatures on these types of requests use asymmetric algos and the public keys in these cases aren't secret material, Otherwise the guidance you cite is still current.
    – identigral
    Aug 23, 2022 at 16:14
  • Hmm, good point. Indeed this could be achieved in asymmetric crypto. The algo I use is here and Pandadoc recommends protecting the key. In the case of HMAC it's symmetric and anyone can generate signature if they have the key. Better choice would be ECDSA or RSA. Regardless, the spirit of the question is how is it not possible to store securely store secrets in Salesforce!?
    – dzh
    Aug 24, 2022 at 12:47
  • It's Salesforce, you know. The best and fully secure option is Certificates and Keys but the only allowed entry is private and public keypair. If you're okay with changing the algo to asymmetric and keeping the private key in SF, then take a look at this answer for details on importing it
    – identigral
    Aug 24, 2022 at 15:45
  • ...but if you do go with Certs and Keys as storage, using the public key to verify the signature isn't going to be easy because Crypto wants the key as a Blob. Still doable but a tough one. Standard storage methods described in Storing Sensitive Data are easier for your scenario.
    – identigral
    Aug 24, 2022 at 17:51

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .