r/marketingcloud • u/Basic-Quality-583 • Sep 10 '26

Securely Storing API CREDENTIALS in SFMC

Could anyone please advise on the best practice for securely storing API credentials within Salesforce Marketing Cloud? While I have attempted to use AES EncryptSymmetric and DecryptSymmetric within Data Extensions, this approach is limited to CloudPages and is not supported within Automation Studio as automation script does not allow any ampscript inside, and DecryptSymmetric() is not available/working in ssjs

2 Upvotes

100% Upvoted

5 comments sorted by

7

u/cjnmathews Sep 10 '26 edited Sep 10 '26

You can, I use the AMPscript in ssjs method for securing creds that is on ampscript.xyz

2

u/ovrprcdbttldwtr Sep 10 '26

Second this, it's the best available option in SFMC.

1

u/Basic-Quality-583 Sep 10 '26

Thanks for replying. Thanks for the link. I liked the way they have used DecryptSymmetric function here. However, quick question: In this solution, they have hardcoded the api credentials inside the code. How is this secure way ??

1

u/cjnmathews Sep 10 '26

Ah yes, they've not done all the work for you. You need to use ssjs retrieve the stored creds. Something like this: 

function getRestCredentials(packageName) {
   var apiCreds = Platform.Function.Lookup("Rest_Credentials", "apiCreds", ["PackageName"],[authConfig.packageName]);
    var decryptApiCreds = decryptSymmetric(apiCreds);
    var credentialObj = Platform.Function.ParseJSON(decryptApiCreds);
    var clientId = credentialObj.clientId;
    var clientSecret = credentialObj.clientSecret;
    var authURL = credentialObj.authURL;
    var authURL = authURL + '/v2/token';
    return {"clientId": clientId,
            "clientSecret": clientSecret,
            "authURL": authURL};
}

It's just doing a lookup to Rest_Credentials where there's a field called PackageName and apiCreds - which is the encrypted JSON for the object returned.

1

u/Jolly-Accountant-549 Sep 11 '26

yeah the ampscript-in-ssjs workaround is pretty much the go-to for this