Most reasonable solution to encrypting my paypal API credentials?

Question

I understand that i'm never going to be completely safe ... but paypal documentation seems to stress that I should never plain-text store the API credentials in my code (ie, web.config or in some C#).

1) What is a reasonable way to protect it... without going OVERBOARD? 2) If I encrypt the keys in my web.config... where do I store the encryption key... in the database, right? But then... the connection strings to my database are also visible in the web.config... so I don't understand why this is considered safety...

My website is an ecommerce store and will probably be on Arvixe business shared server.

Answer 1

I would encrypt the Paypal credentials and store this encrypted information in the web.config. Do the decryption in a separate DLL and obfuscate this DLL. You could also protect this DLL with an external protection system but we have had issues in the past where protected libraries don't always work correctly in shared web environments.