I need to store API keys for my users. These keys are extremely valuable as they are used to buy and sell things. Some users won't want to give these keys to anyone, and I'm trying to figure out a better solution than simply storing them in a database.

It would be nice to some keep control of the key with the user. I consider making an open source script that they can deploy on a server and my app call or similar.

Somone suggested it might be possible to configure a proxy to do something without any code, but this is all beyond my expertise.

Does anyone have any other ideas?

edit: for further clarification

My system is a web app. Each user gives my system their api key, which allows the web app to trade on their behalf (buy and sell things). The essence of the system is that under certain automated circumstances the system will want to trade on the user's behalf.

I am considering a manual intervention with 2FA, which will likely be strong enough in my opinion, but is sub-optimal in that the user won't be able to react fast enough all of the time.

I consider creating some light-weight, open source, partner code that the user can deploy on their own server somewhere. The idea being that it can be independently verified as un-malicious and the user can store the keys themself.

I'm not sure if anything is gained by that approach besides a hacker having to find out the location of script, and even then if my server is compromised they can simply send trades using my system to this script in the same way as if everything was on my server.

I guess the idea of a proxy server would be something like the above, but something at a lower level than an app running on the server. I'm afraid I don't have enough server admin knowledge to speculate on how that might work.

  • 1
    Hi, and welcome to the site. Can you either tell us who mentioned the proxy idea, or remove that bit? I'm struggling to understand what "do something without any code" may refer to since it is so vague.
    – NH.
    Commented Aug 27, 2018 at 15:58
  • Your question is telling us why the keys need to be protected, but doesn't tell us much about how your system actually works. Storing keys (especially if you need automated access to them) is a hard problem and depends on the nit-picky details of how your system is designed and what / how the keys are used for. Can you edit in some technical detail about your system? Commented Aug 27, 2018 at 16:08
  • @NH. I have updated with more info now...
    – Positonic
    Commented Aug 27, 2018 at 17:26
  • @MikeOunsworth I have updated with more info now...
    – Positonic
    Commented Aug 27, 2018 at 17:26
  • Now I'm even more confused. In order to increase security, you want to let users store their api keys on their own device (presumably at a lower security level than you can achieve on your server). But your server still needs to know their key so that it can do actions on their behalf (or be able to call an api that they host which will process the action). So you still have the key on the server, but now have more copies of it floating around the world? Commented Aug 27, 2018 at 18:26

1 Answer 1


Great question, and one that comes up frequently (though always with different nuances, so there's no good general answer). A quick search found some related questions:

In general, you need to decide which use-category your keys fall into, which will tell you what options you have available:

1. Manual access

By this I mean that they key is only needed when there is a human at the keyboard. This scenario is fairly easy to solve: for example you could encrypt the key with a user-entered password. You still need to think about enforcing strong passwords mitigating brute-force attacks, but it's fairly standard; see how SSH password-protects ssh keys to get inspiration.

2. Automated access

If the sensitive keys need to be stored in such a way that they can be used by an automated process with no human at the keyboard, then you're looking at a very difficult problem because of the conflicting requirements that the machine should have access, but an attacker who compromises the machine should not have access.

The standard solutions to this problem include:

  • Attaching a USB smart-card to the server or issuing one to each user.
  • Storing the keys server-side in a secure vault that will use the keys on the user's behalf, and requires users to authenticate using strong two-factor auth.
  • If applicable, Hardware Security Modules.

Clearly the applicable solution depends a lot on the architecture of your environment.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .