CherryPoppins
Let’s say I have an app that handles ordering bubble gum for clients. Each client has their own API credentials for the bubble gum supplier. I handle placing orders for more bubble gum by sending an order request using the client’s API keys. When I had one client I stored their API creds as an ENV and accessed them when making a requests to the bubble gum supplier that way. Now I have more than one client and I need to store all of their API credentials so I can use each client’s API keys accordingly to place orders via API requests.
What is the best way to store these with security in mind? Encrypt the keys then store in DB as :string and decrypt before inserting the keys into the request? If so is there a recommended library for encryption? I’m using Postgres if that matters.
Where Next?
Trending in Questions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
We build reliable cloud platforms for business-critical systems.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #ai
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #blog-post
- #elixirconf-us
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #elixirconf-eu
- #api
- #forms
- #security
- #metaprogramming
Our Sponsors
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Master modern tools, write cleaner code, and tackle real-world challenges.
**Building the future of software with AI, trust, and human connection.**
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 4- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
OvermindDL1
Encrypting is fine, though if you want what’s generally regarded as high security if it’s really that important then I use Consul by Hashicorp, it’s exceedingly powerful for holding encrypted data like access tokens. Encrypting in the database is “fine” but where you hold the decryption key really really matters (in which case something like consul is also great for holding the decryption key). The main important thing is to make it as hard as possible for someone to get that key and what it decrypts even if they have access to the server.
stefanchrobot
cloak_ecto is the library that you’re after.
CherryPoppins
Are you referring to Cloak.Ecto hexdocs? If so, I don’t think I just want it encrypted in the DB. My fear with that would be the Account info would be accidentally preloaded or otherwise pulled from the DB and thrown around the code base where not needed. So, i like the idea of having to intentionally decrypt the account info specifically when I am adding it to the api request, otherwise its always encrypted. So, I am looking at Cloak and wondering if that library is trusted.
stefanchrobot
I think that redacting the field would address your concerns.