I'm working on an app with a base managed package and two extension packages. I need to encrypt a user-entered password as a part of post-installation setup (done right after the base package is installed). The extension packages have batch classes which decrypt this password and make API calls using it. I initially created a "protected" custom setting in the base package to save the key (so that the clients who install our app wouldn't be able to access it). But the batch classes in the extension packages couldn't decrypt the password and the API calls were failing. So I had to use a "public" custom setting to save the key. The batch classes in the extension packages can decrypt the password now, but the key would be visible to the client users (which I don't want). Can anybody please suggest me a better way to handle this issue? Thanks in advance.

1 Answer 1


You extension packages will NOT be able to access any custom setting that is protected and part of the base package as the namespaces are different.

In addition, if you are storing Salesforce Passwords then you will not be able to pass security review (Just FYI) regardless of if you are storing them encrypted in a custom setting. In this case, what you can do is store an oAuth refresh token.

The only way I can see to do this would to hard code the Key in your packages so that you will be able to decrypt the data in any package.

If you want to make the custom setting a little more invisible:

  1. Protect the custom setting
  2. Create a global method that returns the value of the protected custom setting - this way is can be called via the extension package

The global method would be visible to the user if they viewed the class but they would not see the custom setting so they would have to do a little more work.

  • Thanks for your answer, Eric. I'm not storing the salesforce password, it's the password for our API.
    – user12106
    Commented Oct 3, 2014 at 21:19
  • Can the client's salesforce developers add code on their end to call that global class and get the key? Is that a possibility?
    – user12106
    Commented Oct 3, 2014 at 21:22
  • @user12106 - Yes, but it is better than just putting the custom setting as public visible to anyone with access to "view setup". This is only IF you MUST have the key in a custom setting. The best approach would be to code the key in your package
    – Eric
    Commented Oct 3, 2014 at 23:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .