I am writing an application which will take users credentials for a third party site so I can add value by screen scraping their account.

For this I need to be able to store credentials in a secure manner with a reversible crypto so I can get them in the clear again.

What is a secure (and easy) way of doing this for my MVP? Shall I just encrypt with AES and use a composite key (master secret + user account related salt).

Perhaps Vault from Hashicorp would suffice for this?

Asked another way. For the products that scrape your bank account, how do they store credentials?

Thanks guys