HTMLdb Developer
Credential manager
Every key, token and certificate, encrypted. API keys, OAuth tokens and trusted certificate chains for every outbound HTTPS call, encrypted with AES-256 in the database and managed from one tab.
Every feature of Credential manager, and how its security works.
API keys
- Code asks for a key by name: getkey('UPS_OAUTH')
- Plain keys, or OAuth with token URL, body and headers
- Tokens refresh themselves before they expire
- Choose which packages may read each key
- You see only that a value is set and its last 4 characters
Certificates
- Type the API's https address: its chain is read over TLS and stored
- No server files, scripts or Oracle wallets
- Expiry dates in orange under 30 days, red when expired
- A daily job refreshes only the chains about to expire
Calling an API
- request and request_blob: any method, PATCH included
- Headers as lines or curl options; multipart file uploads
- Each API trusts only its own certificate chain
On the record
- Every create, change, delete, token and refresh is logged
- Values are never logged
Security
Signed in with App Builder
Every page and every request checks the APEX session and that the browser is signed in to App Builder as a developer of the workspace. Nothing runs before that check.
Nothing trusted from the browser
Requests are POSTs to the package that owns them. The user and workspace come from the checked session; names, paths and keys are validated before they reach SQL or a URL.
Secrets stay on the server
API keys, OAuth tokens and certificates are stored AES-256 encrypted with a fresh IV for every value. The browser only ever learns whether a secret is set.
