In our managed package, we have a lightning page where the app admin can set a couple of settings related to the app, including an API key to interact with 3rd party system, and all this information from lightning page is stored in custom settings dynamically with an Apex logic when customer clicks on the save button. For a better visibility :

Lighning Page

enter image description here

Custom Setting

enter image description here

The thing is, to store sensitive information like API key in custom settings, custom setting should be in a protected mode because of the security rules, however when I add the protected custom setting to my package and install the package to a different org, the custom setting is not accessible either in my apex code or from setup menu but that doesn't work for my case because I want users to be able to modify the custom setting.

So in this case I guess I need a different solution to store the API key in my package besides protected custom settings, already tried named credentials but they are not supported in 2GP Managed Packages. So what I want to ask is, what is the best practice for storing sensitive information like API keys in such scenarios? Thanks in advance.

1 Answer 1


Protected custom settings can be created, modified, and deleted by Apex code in the managed package. The ISV way is to create a Visualforce page, LWC, etc, and then have those UI components call Apex code to change the custom settings. This design allows the ISV to choose what data is exposed and how it may be set.

  • Ah, If it is accessible via code then it is no problem, somehow my apex logic didn’t work in package and that is why I thought it is not accessible via apex code, I will double check, thanks ! Commented Dec 27, 2023 at 11:34
  • @HasanTokul No worries. It's easy enough to mistake a bug in the code for something else. We all do it from time to time.
    – sfdcfox
    Commented Dec 27, 2023 at 11:51
  • Hello @sfdcfox just packaged my custom setting however when I query this custom setting via apex code like in developer console, I get invalid type error Commented Dec 27, 2023 at 13:07
  • @HasanTokul Correct. The custom setting is available only to Apex that is running in the same namespace (managed package code). An ISV is meant to provide a way to configure the custom setting in an appropriate manner. This might be through a global method in a global class, a Visualforce page, an Aura/Lightning Web Component, etc. Without this protected status, the secrets you're trying to keep secret would be exposed.
    – sfdcfox
    Commented Dec 27, 2023 at 15:24
  • 1
    @HasanTokul No. Protected data is protected. You can only access it from Apex inside the package.
    – sfdcfox
    Commented Dec 28, 2023 at 10:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .