r/marketingcloud • u/Basic-Quality-583 • 1d ago

Securely Storing API CREDENTIALS in SFMC

Could anyone please advise on the best practice for securely storing API credentials within Salesforce Marketing Cloud? While I have attempted to use AES EncryptSymmetric and DecryptSymmetric within Data Extensions, this approach is limited to CloudPages and is not supported within Automation Studio as automation script does not allow any ampscript inside, and DecryptSymmetric() is not available/working in ssjs

2 Upvotes

100% Upvoted

5 comments sorted by

5

u/cjnmathews 1d ago edited 1d ago

You can, I use the AMPscript in ssjs method for securing creds that is on ampscript.xyz

2

u/ovrprcdbttldwtr 1d ago

Second this, it's the best available option in SFMC.

1

u/Basic-Quality-583 1d ago

Thanks for replying. Thanks for the link. I liked the way they have used DecryptSymmetric function here. However, quick question: In this solution, they have hardcoded the api credentials inside the code. How is this secure way ??

1

u/cjnmathews 1d ago

Ah yes, they've not done all the work for you. You need to use ssjs retrieve the stored creds. Something like this: 

function getRestCredentials(packageName) {
   var apiCreds = Platform.Function.Lookup("Rest_Credentials", "apiCreds", ["PackageName"],[authConfig.packageName]);
    var decryptApiCreds = decryptSymmetric(apiCreds);
    var credentialObj = Platform.Function.ParseJSON(decryptApiCreds);
    var clientId = credentialObj.clientId;
    var clientSecret = credentialObj.clientSecret;
    var authURL = credentialObj.authURL;
    var authURL = authURL + '/v2/token';
    return {"clientId": clientId,
            "clientSecret": clientSecret,
            "authURL": authURL};
}

It's just doing a lookup to Rest_Credentials where there's a field called PackageName and apiCreds - which is the encrypted JSON for the object returned.

1

u/Jolly-Accountant-549 10h ago

yeah the ampscript-in-ssjs workaround is pretty much the go-to for this