I am building a web application that has some API calls to other services and currently I am just putting these API keys and secrets in variables which is not very secure.
My objective:
To store/secure these API credentials either in the code or store it into the database in encrypted form maybe.
I am currently coding in PHP and I have scripts in python to call these API services. I am planning to do up an API page where users can enter API credentials and it will be encrypted/hashed and stored into the database. But I am not sure if this is the right way or how to go about it.
Any help on this is welcomed. Thank you.
Actually you in some levels of security you can't be sure that key is private. First of all hashing is not suitable cause you can't reach api key form its hash so you can't use that api! If you encrypt that api key, there will be a key and an algorithem that you use for your encryption. If this information is likely to be leaked, you can do nothing to stop it! But in general, you trust on some layers of security and you can say store application key in an .env file. I think encrypting can be a good idea for storing keys in database in case of data being leaked by database attacks.
How to securely store API keys and secrets?