6 ms·
Store API Credentials Safely: Obfuscation Before Encryption Is Key
- necovek 5y agoHum, the de facto approach to having to offer API keys in plain text is... to not offer them. Basically, you get an API key generated, it's up to you to safely keep it, but the service it allows access to only ever stores the (cryptographically secure) hash. All the services off the top of my head do the same (including the likes of AWS). In a nutshell, don't do what this article suggests.