Storing API Keys for use in scripts

[penfold]

I have a PowerShell script which I am using to run some API calls and grab information which I am running manually. At the minute I am using the AccessKey & SecretKey hardcoded in the script. I want to be able to run it on a schedule so I want to be able to call the keys from the script and remove them from the script itself. I have tried using

ConvertTo-SecureString –AsPlainText –Force | ConvertFrom-SecureString | Out-File "C:\Scripts\File.ini"

and then using the following code

$SecretKey = Get-Content "C:\Scripts\File.ini" | ConvertTo-SecureString

But if I do this I get an error when I try and connect using the API. I am guessing the error is because the call does not recognize the secure string.

I have a feeling I'm going about it all wrong, but I'm not sure what I should be using so I can use the script on a shared server. I am new to API calls and I am at a loss to how I can use Access/Security Key securely. I have searched but am finding a solution using Azure which is not something I can do.

 

How can I store the API Keys securely so I can use them in scripts?

[howartp]

Without looking properly I can't comment on the syntax's of the conversion lines, but one thing I fell for when doing something similar was that I exported the string to file on one PC and was running the script on another; the encryption key for the conversion to/from secure string was therefore different.

 

There is a way to store the encryption key in a safe place so that the same key is used on both conversions if necessary - I had to do this as my script was executing on newly built PCs.

[penfold]

I managed to get this sorted by saving the encrypted keys into single files and then decrypting them in the script. Based on the information I found here - https://kiazhi.github.io/blog/powershell/Working-with-secret-in-PowerShell/

[dmj]

If you need to do this regularly, you probably need Vault from Hashicorp.

It's all opensource:

https://www.hashicorp.com/products/vault

[HPlum78]

So you could use keyvault to store the keys but that comes with some interesting caveats.. PowerShell secret management is also available as well https://devblogs.microsoft.com/powershell/secretmanagement-and-secretstore-are-generally-available/

 

Here is the api reference https://docs.microsoft.com/en-us/rest/api/keyvault/get-secret/get-secret

Edited January 11, 2022 by HPlum78