Where should I store credentials for my java application to access third party services?

Question

Where should I store credentials for my java application to access third party services?

The credentials are not specific per user on my application. They are for accessing a web service my application is consuming. I know enough not to hard code them into my application, but where and how do I store them? I also assume they will need to be encrypted.

Answer 1

To build upon @Zildyan's answer, comments and references to other answers.

There are a few options for where to store:

• Database
• Properties file
• Constant (hard coded)
• File system (away from application)

As for how to store:

Depending upon sensitivity. Credentials could be stored in plain text (low sensitivity) or should be encrypted (high sensitivity).

---

It should also be noted that using a combination of encryption and separating the credentials from the source you would restrict internal access to the credentials.

Some examples

• a password stored in plain text may be added to source control and read by anyone with access to the source control.
• An encrypted password with decryption code would be easily available to anyone able to run the code.
• A plain text file stored on the server may be accessible to anyone with access to the server.
• An encrypted file stored on the file system may only be accessible to sys admins and the decryption method available to devs.

The same goes for storing in a database and who has access to that database.