ajur58
Hello everyone,
I’m implementing an app that consumes an external API. The API returns a Bearer Token valid for 2 hrs after logging in, to be used for every subsequent request. I’m new to Elixir and was wondering where to store this token for the future.
My current approach:
- Standalone application (Agent) to handle communication with this external API
- When the app is started, it tries to authenticate and get the AuthToken (checking expiry date etc)
- The token is saved in the agent’s state, it will be read from here in future calls.
Alternatives that I can think of :
a. Put the AuthToken into env variables with Application.put_env/3 → slight security concerns as if the app crashes, env variables could get dumped to the console. Also, other apps will never need this, so it feels strange.
b. Write it to DB? Could be an overkill, but at least there’ll be one entry per new token, good for tracing.
c. Write to disk.
Might be a dumb question, but would be grateful if someone helps a noob out 
Thanks!
Where Next?
Trending in Questions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Deploy Phoenix to your own VPS with PaaS ease: push-to-deploy, zero downtime, auto SSL, managed Postgres. 14-day free trial at potions.io
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #ai
- #elixirconf-us
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Practical resources that improve the lives of professional developers.
**Building the future of software with AI, trust, and human connection.**
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 2- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
stefanchrobot
Keeping the token in memory means that it will most likely not survive application restarts (unless you have distribution configured). If that’s an issue, I’d store it in the DB as an encrypted field. If that’s not a concern, keeping it in an Agent seems fine to me.
Note that keeping the token in memory can make it leak - if a process crashes, the current process state can get dumped to a log file. For improved security consider wrapping the token in a struct with overriden Inspect implementation or using a redacted field in Ecto.
ajur58
Thanks for your answer! Interesting stuff about leaky process state, will definitely keep it in mind.