# Password Management

**URL:** <https://forum.inductiveautomation.com/t/password-management/26257>\
**Category:** Ignition\
**Created:** [July 3, 2019, 8:55am UTC](https://forum.inductiveautomation.com/t/password-management/26257 "2019-07-03T08:55:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![deon.korb](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@deon.korb](https://forum.inductiveautomation.com/u/deon.korb)\
**Post date:** [July 3, 2019, 8:55am UTC](https://forum.inductiveautomation.com/t/password-management/26257/1 "2019-07-03T08:55:10Z")

</div>

Hi,

I have to perform a web call and would like to use https, where a password must be provided. See below:  
 ![Canary%20Password](https://us1.discourse-cdn.com/inductiveautomation/original/2X/8/8e3df053bff3b1f15698724582a7746253d2dc50.png)

What is the best practice for storing and passing the password? I would not like to have it hard coded in the script or visible anywhere for that matter. Just trying to apply sound security practices, regardless of how small the risk may be.

Thanks,  
Deon

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [July 3, 2019, 12:04pm UTC](https://forum.inductiveautomation.com/t/password-management/26257/2 "2019-07-03T12:04:13Z")

</div>

Passing the password generally has to be in clear text within the https stream. On your end, it must therefore be stored in clear text _somewhere_, or reversibly encrypted. A good option is to place your credentials in JSON format in a file on your gateway with the file’s permissions set to allow only the gateway service to read it.

---

<div class="post-metadata">

**Author:** ![deon.korb](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@deon.korb](https://forum.inductiveautomation.com/u/deon.korb)\
**Post date:** [July 4, 2019, 11:41am UTC](https://forum.inductiveautomation.com/t/password-management/26257/3 "2019-07-04T11:41:06Z")

</div>

The protected JSON can work.

Brings me to another question:  
What’s a good way of making the file location available to the scripts? I thought of making a parameter tag and just reading that.

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [July 5, 2019, 4:46pm UTC](https://forum.inductiveautomation.com/t/password-management/26257/4 "2019-07-05T16:46:25Z")

</div>

I would read the file during script module startup from a fixed location, directly into a json object. Gateway scripts can then just access that object’s properties.