I've seen a few questions here with similar concerns but i felt like this specific question wasn't asked or replied to, so I'll try my best to illustrate my case here.
The problem:
- The platform I'm developing consists of a "3rd party APIs" function aggregator and normalizer as in: my users will provide their API KEYS and i have to store them
- Users need to provide several API KEYs for 3rd party APIs
- The application needs to API Calls on behalf of the user, even when the user isn't logged in ( during background tasks )
- When calling 3rd party APIs I'll need the cleartext form of those keys and secrets
My infrastructure:
- I currently use Heroku ( for my http server ) which theoretically guarantee nobody can access my machines via SSH or other means
- My pass guarantees only a selected amount of users ( ideally using 2 factor authentication ) have access to the control panel, therefore to the ENV variables, therefore to the database credentials
My current plan:
- Store API KEYS on a separate server which issues its own token for future authentication
- Only accept API calls from my own http servers ( using some sort of private VPN )
- Exposes an API which only gives access to a few selected functions then used by my other servers, this way reducing the attack surface of my system to only this machine with minimal software installed ( a minimal node.js http api ).
My pass recommendation:
- Use heroku to run my "key manager servixe"
- Store database credentials on ENV variables and don't give access to this account to anyone other than the "keys admin" which will be the only person able to login into the pass dashboard and see the database address/credentials
Questions:
- What is the most secure way to store and use those keys?
- Is there any option that is more secure than simply storing the keys on a database which the address/credentials are protected by a two-factor authenticated dashboard?
Thank You