# How to securely store username and password for an API within my app **URL:** \ **Category:** Developers\ **Created:** [November 15, 2022, 9:14am UTC](https://community.homey.app/t/how-to-securely-store-username-and-password-for-an-api-within-my-app/72180 "2022-11-15T09:14:20Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Jonathan\_Draper](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/jonathan_draper/32/33978_2.png) [@Jonathan\_Draper](https://community.homey.app/u/Jonathan_Draper)\ **Post date:** [November 15, 2022, 9:14am UTC](https://community.homey.app/t/how-to-securely-store-username-and-password-for-an-api-within-my-app/72180/1 "2022-11-15T09:14:20Z")
Hi all Complete newbie homey app and Java script developer here, building my first app and I’m looking for advice on how to securely store a user’s username and password entered into app settings for my app. The app accesses an API that uses JWT for authentication. Each issued JWT expires after 7 days so I will periodically make a new API call to get a new JWT. That API call takes as parameters the user’s username and password for the api. Since this is security related I don’t want to do this by trial and error and get it wrong. Please could someone point me in the right direction or even better point me at a code example of how best to persist a username and password entered into app settings in my homey app? Thanks in advance. Jon ---
**Author:** ![Mickel\_Luiten](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/mickel_luiten/32/12404_2.png) [@Mickel\_Luiten](https://community.homey.app/u/Mickel_Luiten)\ **Post date:** [November 15, 2022, 11:24am UTC](https://community.homey.app/t/how-to-securely-store-username-and-password-for-an-api-within-my-app/72180/2 "2022-11-15T11:24:13Z")
See [ManagerSettings - Homey Apps SDK v3](https://apps-sdk-v3.developer.homey.app/ManagerSettings.html#set) `this.homey.settings.set('username', username);` to get `const username = this.homey.settings.get('username');` ---
**Author:** ![Jonathan\_Draper](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/jonathan_draper/32/33978_2.png) [@Jonathan\_Draper](https://community.homey.app/u/Jonathan_Draper)\ **Post date:** [November 15, 2022, 12:59pm UTC](https://community.homey.app/t/how-to-securely-store-username-and-password-for-an-api-within-my-app/72180/3 "2022-11-15T12:59:02Z")
Perfect. Thanks Mickel ---
**Author:** ![Arie\_J\_Godschalk](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/arie_j_godschalk/32/63027_2.png) [@Arie\_J\_Godschalk](https://community.homey.app/u/Arie_J_Godschalk)\ **Post date:** [November 15, 2022, 1:22pm UTC](https://community.homey.app/t/how-to-securely-store-username-and-password-for-an-api-within-my-app/72180/4 "2022-11-15T13:22:22Z")
Please do know that your App Settings can be read by ANY App that has access to the Athom-Api (no permission for your app is needed). There are a lott of ways the settings are include, but for example: `return await Homey.apps.getAppSettings({id:'nl.qluster-it.DeviceCapabilities'})` So, some apps, like my lovely Device Capabilities, will “recieve” that information also (It itterates through the Apps). So, the only way to be save (well, relativly) is to have it encrypted and have the keys only in memory (your app). Reading out your sourcecode is not possible with other apps (atm), so it’s “save” to have active keys in memory on your own Homey. ---
**Author:** ![Jonathan\_Draper](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/jonathan_draper/32/33978_2.png) [@Jonathan\_Draper](https://community.homey.app/u/Jonathan_Draper)\ **Post date:** [November 18, 2022, 9:23pm UTC](https://community.homey.app/t/how-to-securely-store-username-and-password-for-an-api-within-my-app/72180/5 "2022-11-18T21:23:57Z")
Thanks Arie. I will look into how I can do encryption then ---
**Author:** ![Arie\_J\_Godschalk](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/arie_j_godschalk/32/63027_2.png) [@Arie\_J\_Godschalk](https://community.homey.app/u/Arie_J_Godschalk)\ **Post date:** [November 18, 2022, 11:14pm UTC](https://community.homey.app/t/how-to-securely-store-username-and-password-for-an-api-within-my-app/72180/6 "2022-11-18T23:14:17Z")
Devices also have a Store for saving data. It might be that other apps cannot read that, im not sure. You can create a device like AVD (it uses that store) and then check the device in HS to see if you can see the store value. (Sorry, i cant do it, im on my phone) ---
**Author:** ![martijnpoppen](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/martijnpoppen/32/84849_2.png) [@martijnpoppen](https://community.homey.app/u/martijnpoppen)\ **Post date:** [November 19, 2022, 6:17pm UTC](https://community.homey.app/t/how-to-securely-store-username-and-password-for-an-api-within-my-app/72180/7 "2022-11-19T18:17:35Z")
@Jonathan_Draper in that kind of cases i have a env.json with a secret key. And then I encrypt the password with that key. encrypt function Example here: [com.synology/helpers.js at main · martijnpoppen/com.synology · GitHub](https://github.com/martijnpoppen/com.synology/blob/main/lib/helpers.js#L55) ---
**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\ **Post date:** [November 19, 2022, 6:22pm UTC](https://community.homey.app/t/how-to-securely-store-username-and-password-for-an-api-within-my-app/72180/8 "2022-11-19T18:22:52Z")
It’s been suggested by Athom that with the new Homey Pro all files belonging to an app will be readable by adventurous users. ---
**Author:** ![martijnpoppen](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/martijnpoppen/32/84849_2.png) [@martijnpoppen](https://community.homey.app/u/martijnpoppen)\ **Post date:** [November 19, 2022, 6:24pm UTC](https://community.homey.app/t/how-to-securely-store-username-and-password-for-an-api-within-my-app/72180/9 "2022-11-19T18:24:27Z")
As far as i know the env.json is not accessible 😕 ---
**Author:** ![DaneedeKruyff](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/daneedekruyff/32/964_2.png) [@DaneedeKruyff](https://community.homey.app/u/DaneedeKruyff)\ **Post date:** [November 19, 2022, 6:28pm UTC](https://community.homey.app/t/how-to-securely-store-username-and-password-for-an-api-within-my-app/72180/10 "2022-11-19T18:28:06Z")
Yes, for now. But on the new Homey Pro 2023 it will be different, as written in the developer update. > **The new Homey Pro can be fully backed up to a Mac or PC using USB. This means the entire operating system & userdata is saved**.Because of this new feature, it’s considerably easier for users to access and/or change Homey Pro’s filesystem, and therefore an app’s JavaScript code and environment variables. The question how information in a env.json will be protected remains unanswered, not in the AMA nor on slack.: > [@The new Homey Pro — Ask Me Anything](https://community.homey.app/t/the-new-homey-pro-ask-me-anything/70378/36): > > Quote from the Developer Update e-mail: Q: How will information from env.json be protected? ---
**Author:** ![martijnpoppen](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/martijnpoppen/32/84849_2.png) [@martijnpoppen](https://community.homey.app/u/martijnpoppen)\ **Post date:** [November 19, 2022, 6:29pm UTC](https://community.homey.app/t/how-to-securely-store-username-and-password-for-an-api-within-my-app/72180/11 "2022-11-19T18:29:01Z")
Ah yes… I sent athom a message, lets hope they’ll explain that part ---
**Author:** ![DaneedeKruyff](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/daneedekruyff/32/964_2.png) [@DaneedeKruyff](https://community.homey.app/u/DaneedeKruyff)\ **Post date:** [November 19, 2022, 6:29pm UTC](https://community.homey.app/t/how-to-securely-store-username-and-password-for-an-api-within-my-app/72180/12 "2022-11-19T18:29:49Z")
I hope they will answer you 😉 ---
**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\ **Post date:** [November 19, 2022, 6:44pm UTC](https://community.homey.app/t/how-to-securely-store-username-and-password-for-an-api-within-my-app/72180/13 "2022-11-19T18:44:33Z")
This is what they wrote in the developer newsletter from October 12th: > The new Homey Pro can be fully backed up to a Mac or PC using USB. This means the entire operating system & userdata is saved. > Because of this new feature, it’s considerably easier for users to access and/or change Homey Pro’s filesystem, and therefore an app’s JavaScript code and environment variables. ---
**Author:** ![martijnpoppen](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/martijnpoppen/32/84849_2.png) [@martijnpoppen](https://community.homey.app/u/martijnpoppen)\ **Post date:** [November 19, 2022, 7:06pm UTC](https://community.homey.app/t/how-to-securely-store-username-and-password-for-an-api-within-my-app/72180/14 "2022-11-19T19:06:28Z")
Yes but you might expect they’ll provide a alternative for env vars right 🙂 ---
**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\ **Post date:** [November 19, 2022, 7:08pm UTC](https://community.homey.app/t/how-to-securely-store-username-and-password-for-an-api-within-my-app/72180/15 "2022-11-19T19:08:53Z")
Well… ![Screenshot 2022-10-14 at 13.03.44](https://us1.discourse-cdn.com/flex025/uploads/athom/original/3X/5/d/5da14e5680a5e57ce6213b5eb6bd1b76df5c9da0.png) ---
**Author:** ![martijnpoppen](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/martijnpoppen/32/84849_2.png) [@martijnpoppen](https://community.homey.app/u/martijnpoppen)\ **Post date:** [November 19, 2022, 7:14pm UTC](https://community.homey.app/t/how-to-securely-store-username-and-password-for-an-api-within-my-app/72180/16 "2022-11-19T19:14:59Z")
Ah well… ☹ ---
**Author:** ![Arie\_J\_Godschalk](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/arie_j_godschalk/32/63027_2.png) [@Arie\_J\_Godschalk](https://community.homey.app/u/Arie_J_Godschalk)\ **Post date:** [November 19, 2022, 7:41pm UTC](https://community.homey.app/t/how-to-securely-store-username-and-password-for-an-api-within-my-app/72180/17 "2022-11-19T19:41:08Z")
Okay @Jonathan_Draper , i just checked: I cannot seem to find a way to read the Store Values from devices from another App. Meaning, you could just store the Username and Password, or a Random Generated Encryption Key, in A device’s [Store](https://apps.developer.homey.app/the-basics/devices#store). Afaik, This can only be read by the App itself. Even the Webpi Playground cannot access this information as far as i can see (if i am wrong, please let me know). I understand a User could open it’s own Homey and access the fields, but that’s not an issue right? You asked about saving it’s username and password, i guess this is the savest way. Now you talk about JWT, so i’ll asume you also have some other “secret” key (i know it can work without, but then the App-ID or whatever). I don’t know where to save that, since, as you can read above, in a short while ,ever user can read your source code (ncluding the env.json). But for storing a username and password from the user itself in a save way that other apps or remote access cannot read it, the Device Store seems to me like the fitting solution. ---
**Author:** ![Jonathan\_Draper](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/jonathan_draper/32/33978_2.png) [@Jonathan\_Draper](https://community.homey.app/u/Jonathan_Draper)\ **Post date:** [November 19, 2022, 8:30pm UTC](https://community.homey.app/t/how-to-securely-store-username-and-password-for-an-api-within-my-app/72180/18 "2022-11-19T20:30:39Z")
Thank you @Arie_J_Godschalk for your detailed reply. This is great. For the JWT I don’t think I will need to persist that since I can make an API call with the username and password to get a JWT back and just keep that in memory as far as I can tell. All the other calls then take the JWT and an app ID which is just public for all calls to this api Thank you again for your help ---
**Author:** ![DaneedeKruyff](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/daneedekruyff/32/964_2.png) [@DaneedeKruyff](https://community.homey.app/u/DaneedeKruyff)\ **Post date:** [November 20, 2022, 7:54am UTC](https://community.homey.app/t/how-to-securely-store-username-and-password-for-an-api-within-my-app/72180/19 "2022-11-20T07:54:11Z")
To be honest, while @Arie_J_Godschalk method seems to be a solution it is also based on his assumptions and the fact he can see no method to retreive the stored information in from outside the app. It’s not that I’m not trusting Arie’s knowledge but I would go for the facts and not assumptions so I suggest you have this method confirmed by Athom. ---
**Author:** ![Arie\_J\_Godschalk](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/arie_j_godschalk/32/63027_2.png) [@Arie\_J\_Godschalk](https://community.homey.app/u/Arie_J_Godschalk)\ **Post date:** [November 20, 2022, 8:16am UTC](https://community.homey.app/t/how-to-securely-store-username-and-password-for-an-api-within-my-app/72180/20 "2022-11-20T08:16:21Z")
> [@DaneedeKruyff](#): > > It’s not that I’m not trusting Arie’s knowledge but I would go for the facts and not assumptions so I suggest you have this method confirmed by Athom. Indeed, it’s an assumption and if you can verify it, that would certainly be the smart thing to do! Also, i just checked basic homey ways to check the access, i have not tried any real hacks or anythink and i am not very knowledgeable about node.js. [Next page](https://community.homey.app/t/how-to-securely-store-username-and-password-for-an-api-within-my-app/72180.md?page=2)