Community

Hi! I have a question about safely storing/using external api tokens in settings:

So, if a external api token (like Zendesk token) is stored in the settings and its role is not defined, it will be available for all users through the api. This way an authenticated user would be able to get our token with an api call which is not cool.

So, the first thing to combat this that came to mind was to simply block the /my/config/settings endpoint externally.

Then I started to think if there could be other ways to limit the token availability and came up with:

Limit all the settings to be role admin and then run the parts of processes that need to write to external systems as separate smaller flows with ElevatedApiRequest and impersonate the admin user (or a user with admin privileges). I did this as a test and it seems to work fine in my quick testing 😄 Is it stupid unnecessary extra complication? And what is the proper way to do things here?