# APIs Credential key \_ security Audit

**URL:** <https://forum.inductiveautomation.com/t/apis-credential-key-security-audit/99978>\
**Category:** General Discussion\
**Tags:** ignition81, scripting\
**Created:** [December 18, 2024, 1:29pm UTC](https://forum.inductiveautomation.com/t/apis-credential-key-security-audit/99978 "2024-12-18T13:29:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yousef\_Ali](https://avatars.discourse-cdn.com/v4/letter/y/87869e/32.png) [@Yousef\_Ali](https://forum.inductiveautomation.com/u/Yousef_Ali)\
**Post date:** [December 18, 2024, 1:29pm UTC](https://forum.inductiveautomation.com/t/apis-credential-key-security-audit/99978/1 "2024-12-18T13:29:45Z")

</div>

i have Api send data to other system .. i got a concern and refuse from security team about keeping Credential on my code or store it in Database .

Even when i purposed to them keep it on OS variable, they refused because anyone can get it from our code ?

So, the API on Hold now .. What's your best practices of this situation

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [December 18, 2024, 2:10pm UTC](https://forum.inductiveautomation.com/t/apis-credential-key-security-audit/99978/2 "2024-12-18T14:10:40Z")

</div>

I recommend placing secrets in a JSON file in Ignition's main install folder (outside the `data/` subfolder). That will exclude it from gateway backups. Set permissions on the file so only the Ignition service user can read the file.

In a project library script, read the file and decode it into a python top-level variable. Other functions in that script will be able to retrieve the secrets as needed.

In your dev environment, place a file with testing credentials in the same place.