Securing Sensitive Data in Business Central AL using SecretText
SecretText is a data type in Business Central AL that protects sensitive values like API keys and authentication credentials from being exposed in debuggers or passed insecurely between procedures. The post demonstrates how to use SecretText with JSON objects and isolated storage to keep secrets hidden during extension development.
post Aardvark Labs
"When I look at this with my debugger all the SecretText values are displayed as HiddenValues. No snooping for me!"
Key points
- SecretText variables display as HiddenValues in the debugger and cannot be converted back to plain text
- Use WriteWithSecretsTo method with a Dictionary to safely embed SecretText values into JSON objects by replacing placeholders
- SecretText can be retrieved from Isolated Storage or Azure Vault and used with HTTPClient and Azure OpenAI authentication
- SecretText implements a write-once reveal-never pattern where values are stored once but never retrieved in human-readable form
Quotes
- “When I look at this with my debugger all the SecretText values are displayed as HiddenValues. No snooping for me!” (Demonstrates that SecretText protects against debugger inspection, a key threat when handling API keys and credentials)
Context
- Features: SecretText data type, WriteWithSecretsTo method, Isolated Storage, HTTPClient, Azure OpenAI, Dictionary, JsonObject
Source: Aardvark Labs, community blog. Summary, key points and quotes are derived (CONTENT-NOTICE.md); read the original for the full text.