Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in
Deleted user
0 / 0 points
Next:
badges earned

Your Points Tracker
Challenges
Leaderboard
  • Global
  • Feed

Badge for your thoughts?

You're enrolled in our new beta rewards program. Join our group to get the inside scoop and share your feedback.

Join group
Recognition
Give the gift of kudos
You have 0 kudos available to give
Who do you want to recognize?
Why do you want to recognize them?
Kudos
Great job appreciating your peers!
Check back soon to give more kudos.

Past Kudos Given
No kudos given
You haven't given any kudos yet. Share the love above and you'll see it here.

It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

is it safe to encrypt and store api key in entity properties?

I am trying to create a connect or forge app?
After installation of the app the user gives api key in the app?I would like to encrypt and store the user input api key in entity properties(https://developer.atlassian.com/cloud/jira/software/storing-data-with-entity-properties/).Is it safe to encode and store api key in the properties?
Can you also suggest which is the best method to do so?
Thanks in advance

1 answer

0 votes
Andy Heinzer Atlassian Team May 07, 2021

An API key is not really what I would expect to be safe data to store inside an entity property.  The main reason being explained at the bottom of the page you linked:

Users can access entity and app properties using the REST APIs. For this reason, never store private user data or configuration information using entity properties or app properties.

Even if you were to encode that kind of information, other users could potentially access that data via the REST APIs.  So in short, No, I don't think that is an appropriate data to store there.

But I am also confused as to why you would need to store that information.  Is this an API key that is expected to be used to call an Atlassian Cloud service?  If so then there should be no need to get this info from the user.  Instead Connect apps are expected instead to leverage a JWT token at the time of installation as explained in Security for Connect apps.  Is there some reason you are not using that to make REST calls here?

Andy

@Andy Heinzer  Thanks for the valuable response
I am making an app in jira which retrieves some details from my website using rest api.So when the user opens the app for the first time he needs to enter the API key and press a button to retrieve the details.But from the next time the user should be able to retrieve the details with just the click of a button,so after clicking the button we need to fetch the api key from where ever it is stored to do the api call.For this purpose I want to store the api key.Can you please suggest how can I go about it?
Thankyou 

Andy Heinzer Atlassian Team May 10, 2021

Check out Cloud, server, and Data Center for developers specifically there is a section on 'Persistent storage' that explains you can use your own database with a connect app that could be used to store such data.  There is a note there as well though that if this information you store is user-identifying then it must then also follow the GDPR specifications.

I hope this is helpful, but if you need additional help on this topic, it might be better to post to our Developer Community over in https://community.developer.atlassian.com/ that site is better focused to address such problems of app development.

Cheers,

Andy

Thanks for the response @Andy Heinzer 

I would like to create database of my own.
Can I know
1.Where can the Database be created?
2.How can the authentication to access this Database can be handled?
Thanks in advance

Hello Harshit,

These are great questions that can be difficult to answer due to each company/vendor/app may require a different stack, security model, and deployment which translates to different storage requirements.

The database choice is open to your choosing and is not dictated by Atlassian on which ones you can or should use.

As far as authentication, this is again dependant on how you manage your deployment and your requirements. The links above are great resources, we would also suggest reviewing the following Security requirements for cloud applications  to understand how this may impact your database choice along with your authentication method.

We would suggest reaching out to https://community.developer.atlassian.com/ as there are multiple other application developers within our Developer Community available to help answer your more specific questions.

Regards,
Stephen Sifers 

Suggest an answer

Log in or Sign up to answer
DEPLOYMENT TYPE
CLOUD
PRODUCT PLAN
FREE
PERMISSIONS LEVEL
Site Admin
TAGS
Community showcase
Published in Jira Service Management

JSM June ask me anything (AMA)

Hello Community members! We’re wrapping up the end of JSM June with an Ask Me Anything (AMA) with the Jira Service Management product team. This is your chance to ask all your ITSM questions to o...

159 views 9 10
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you