3 ms·

Ask HN: Best practice for storing API keys securely in a B2B SaaS

My company builds B2B software that has integrations with other systems. These usually require an API key or similar. When connecting to these systems, we need the API key as plain text. What is the best practice for storing integrations API keys? Storing it as plain text in our DB, might be risky in case our DB is compromised. Thanks

ayi 5y ago
Deploying them as ENV values and reading from env is the best practice as far as I know. But "deploying" part depends on your infrastructure.
- securityquest 5y ago
  Do you store them as plaintext in the backend db?
  - tedyoung 5y ago
    Often keys are stored in some sort of secure Key Vault. This is part of the infrastructure, e.g., Azure Key Vault. Or something like https://www.vaultproject.io/docs/secrets https://www.vaultproject.io/docs/secrets
lioeters 5y ago
API keys are typically stored as environment variables: https://help.openai.com/en/articles/5112595-best-practices-for-api-key-safety https://help.openai.com/en/articles/5112595-best-practices-f...