Safest way to store auth credentials?

Resources Plugins
,
1

Hi there :slight_smile:
Still figuring out the plugin-workflow. I was wondering what is considered ‘best-practice’ when it comes to storing credentials used by a plugin.

I’m building an api-plugin that fetches data from another kirby cms, which uses the kql-plugin and thus requires basic auth.

I don’t want the credentials to be stolen obviously :smile: I’m just not too familiar with what directories are generally considered ‘safe’. I would think the .env in the root would be pretty safe?

2

It doesn’t really matter where you store credentials as long as it isn’t in a publicly available folder (like assets). Ideally, you would of course, store anything that should not be accessible “above the web root”, but this is usually not possible on shared hosting.

Note that basic auth is intended for server-side authentication, not for client-side.