3 ms·

Ask HN: What are the best practices for storing API keys?

7 points by loourr 11y ago

If I have a web service which uses other 3rd party API and I want to store the keys securely, what are the best practices around that? I've looked at vault (https://hashicorp.com/blog/vault.html) which seems ideal but still in production. Also AWS's Key Management system (KMS)(https://aws.amazon.com/kms/) seems promising but only provides ways to store native AWS keys. Would I then create a database which held the keys encrypted using KMS keys and SQL access keys?

hoare 11y ago
about how many api keys are we talking? im using enviroment variables for the job. Might not be manageable if you have many keys though
- loourr 11y ago
  like 20+. That seems hard since you'd have to make sure the keys didn't show up in any of your logs.
SEJeff 11y ago
Another option, which is used in production by cloudflare: https://github.com/cloudflare/redoctober https://github.com/cloudflare/redoctober
- loourr 11y ago
  Thanks, this looks useful.
deleted 11y ago
[deleted]