I've written a Drupal 8 custom module that communicates with 3rd party APIs which need authentication. I have an application username and password for those APIs which I need to store somewhere. I can think of the following two ways to achieve that.

  1. I can store the credentials in the Drupal database as configuration. But the password then becomes visible in plain text to all the site admins, and we don't want all the site admins to see the password (I also am aware that we can set up roles and permissions, so we can disable access to a particular configuration for all the site admins, but still the password is saved in plain text in the database).

  2. I can also store the credentials in the settings.php file.

Is there any other way we can store these credentials? What is the best, secure and preferred way to store 3rd party account credentials in Drupal 8?

  • Instead of your form submit saving to site config, you could perform a DB merge query. This would always leave your form empty... Commented Apr 8, 2019 at 0:56
  • @Prestosaurus Can you please explain what you meant by doing a DB merge query? Where will the password get saved to? If I put the field type as password, it wouldn't be visible in the form. But it'll always be visible when we go to Configuration Synchronization and view the configuration there. Commented Apr 8, 2019 at 1:26
  • 1
    but still the password is saved in plain text in the database well... you gotta trust your admins. Even if you encrypt the text, they could prob still decrypt it if they have access to your file system.
    – No Sssweat
    Commented Apr 8, 2019 at 2:16
  • Some of these 3rd parties have settings where you can set it so that it only works from your specific domain name.
    – No Sssweat
    Commented Apr 8, 2019 at 2:21
  • 1
    Doesn't the API provide an access token? You really shouldn't store a full access username and password anywhere.
    – hansfn
    Commented Apr 8, 2019 at 11:27

2 Answers 2


Yes, if you're looking for a Drupal-centric solution, the Key module might provide what you're looking for. It supports pulling your stored secrets from a few different locations:

  • Config
  • File
  • Environment Variable
  • 3rd party services

As far a best, there's really no one-size-fits-all answer. It depends on your data storage requirements and what you're protecting (e.g. an API key for a medical records REST API should have heavy restrictions whereas a Slack webhook is pretty low risk).

If you're wanting a scalable solution, you might want to consider one of the many 3rd party services that provide secret management.

  • Thanks for letting know of this module. This has so many features apart from easy ways to fetch the content stored in several places like Drupal Config, File system, etc. If I store the password in settings.php, I can access it from the Custom Module code that I've written. Can a Drupal Admin see the contents of the settings.php file? Commented Apr 10, 2019 at 18:50
  • 1
    If you've configured the site such that an admin can't inject arbitrary PHP (e.g. Devel module, PHP field, etc.) you should be fine.
    – Shawn Conn
    Commented Apr 10, 2019 at 20:08

What about creating a specific permission 'view users password' and give it only to specified user's role 'super admin'? And disable this permission for basic 'administrator' role?

Then your users may store 3rd party app passwords in specified fields and your admins won't see it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.