Storing Sensitive 3rd Party API keys/tokens

Help
1

I’m in the process of writing an interface extension that requires authorised API access to the YouTube Data API, going through its OAuth2 flow. This means I need to store not only the client_secrets.json, but also the refresh tokens and additional data relevant to the auth process.

I havn’t found a good mechanism or place to store data like that. Previous versions of this extension in other CMS systems has involved just writing these values in text to disk, which isn’t the most secure but at least would need raw machine access to reveal.

My options that I can see after combing the docs are the following.

  1. Directly write JSON to disk, bypassing Directus entirely.
  2. Use the Directus Files Service, which would require manual configuration of the public policy for the directus_files collection using a custom rule to ensure that only admins have access to the files.
  3. Create a collection purely for storing this information, also requiring manual configuration to ensure it’s not published. (is it possible to create the collection programatically? Can I configure the public policy via the API?)

Also, before it’s suggested I’m trying to avoid 3rd party secrets management services. They are all too expensive for this small project, and want to avoid Amazon because Amazon.

Which of these three options would be recommended? Are there better options out there?

2

Have you taken a look at this extension by @Attacler ?

3

Hi @xenobytezero,

Welcome to the Directus community.
As Bryant said, i have made an extension that can encrypt/decrypt collection fields on the fly.
So you would need to create an collection (or reuse an existing one), add a JSON field and configure the extension and you should be good to go.

You can always shoot me a message if you need help!