I have an app in which users need to enter their API keys for third-party services,
What is the best way to store users' API keys? I know we can encrypt them using a private key but that arises another problem, how to securely store the encryption key? We don't want to have a like one encryption key for all of the users.
Thanks for your help
The correct answer is dedicated secret storage. If you are using a cloud deployment the AWS Secrets Manager, GCP Secret Manager or Azure Key Vault are the offerings from the big three cloud vendors.
If you are deploying on a kubernetes cluster you can use the built in secret storage.
Or in any scenario you can use dedicated third party secret storage software, such as Hashicorp Vault, akeyless or others.
If you have very valuable keys that should never be out in the open (and you have plenty of money to spend) you should look into hardware security modules, for example ulitmaco. These can provide key usage without the key ever leaving the secured device. The cloud vendors also offer services using HSMs, for example AWS CloudHSM, GCP Cloud HSM, Azure Dedicated HSM.
For keys you need on the application side: You should never store secrets in the code repository nor on disk during deployment. A good practice is to either use environment variables or a temporary file that gets deleted after startup (in case of containers, where you can restart the whole container).
