I'm working on a service which in the end will pull sales reports etc from an App Store account. The main problem with it though is that Apple (so far) doesn't have a public API to make this possible so the only way to achieve this is to have the Apple ID and Password in plain form to at least achieve it through scraping.
That ultimately brought up one major security problem: How to store it as securely as possible?
On the technical part, the back-end services of the project will run off of PHP. I've also investigated some different services and libraries but all utilize the usage of a clear Apple password.
I was mostly thinking of having them stored on a separate server with no-login and only accessible from one host and with an SSH key. The service needs to be able to store as well as retrieve passwords.
But it for me still feels as not secure enough as the SSH key would still be on the single host and if it were to be compromised, access to the password store is just a command away.
How would it be most applicable to have clear passwords stored?