How to save multiple credentials securely for an API in Python Flask?

Question

What is a secure way to save multiple credentials needed by an API developed in Python Flask?

Is it ok to encrypt/hash and save credentials in a database or configuration file? As storing data this way seems to be insecure and also when password changes, we'll have to update the database somehow.

Is there any better way available?

Answer 1

For production environments, secrets are usually kept in something designed to keep secrets, such as Hashicorp secrets vault, Azure Key Vault or AWS Secrets Manager. These are securely kept in the environments and are only available there.

Developing locally you could use Keybase as a place to keep your secrets in files and mount the secrets directory.

Just remember that encrypting your credentials is pointless if you hardcode the decryption key in the source code, which brings you back to the same question, where do you keep your decryption key? The answer; secrets manager / vaults.