CODEWITHSUNDEEP
securitywebweb-applications
Bob Bobson The Third Esq.
Bob Bobson The Third Esq.

Reputation: 134

Securely saving API keys in database

We are implementing a web app where we want users to log in to our website and enter API keys that allows them to authenticate to website #2. We want to save the API keys to a database so that users only have to enter them once. What are the standard best practices for securely saving the API keys to the database such that we, the developers, can’t access them? Salt and hash? How do we make users feel at ease with providing our app with the API keys?

Upvotes: 0

Views: 283

Answers (2)

user7684550
user7684550

Reputation:

Maybe you can go with the salt & hash but there is another option too which is to implement a Diffie–Hellman key exchange or SRP protocol

Upvotes: 0

Johan Sjolen
Johan Sjolen

Reputation: 143

Salt and hash (or more precisely just hashing) is a one-way street, you can't get back the contents you put into the hashing function from the hash you've received.

Frankly for protection against devs you should probably set up a legal contract between the two parties (you and customer) and SO can't help with that.

The keyword you're looking for is encryption. For example public/private key encryption through GnuPG or OpenSSL where you hand over the private key to the user (through a SSL connection of course) or encrypt the bytes with GnuPG with a passphrase that is the user's password.

There are a lot of options but you should probably re-submit this question with better phrasing using the knowledge you gain after googling all of the phrases I just used.

Upvotes: 1

Related Questions