How do I store a password in such a way that I can obtain the plain-text password again?
0
votes
0
answers
78
views
Consider the following scenario:
My app is utilizing a third-party API which requires a username and password for authentication. Unlike most APIs, which have one username and password set for the developer to make calls, this API has a unique username and password pair for each customer. Thus, each customer using my app will need to input their username and password for their account on this other service, into my app. I then need to store this data in my own database, as I will need to call the third-party API on my customer's behalf repeatedly without asking them for their credentials over and over. (Several well-known apps use this model, such as the fintech company Plaid.)
I know that the de-facto standard for storing passwords in a database is by using a one-way hashing algorithm. However, in my case, I can't see how this would work, as I need to present a plain-text password to the third-party API, and cannot do so if I've only stored hashed information.
I've had trouble finding clear or trusted guidance about how to proceed in this situation. I'm open to the idea that there are other avenues with this scenario I haven't considered. How can I store the passwords in a secure way (if someone got access to my database, they couldn't get their hands on plain text passwords) in this situation?
Asked by JCollier
(101 rep)
Mar 19, 2024, 04:45 AM
Last activity: Mar 19, 2024, 03:30 PM
Last activity: Mar 19, 2024, 03:30 PM