---
schema_version: "1"
id: b58699a65d2200a9c732c1a442c9fcfd60072b160ecf3c0c4e7336c8a96196f4
title: Secret Storage in B2C Commerce
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_secret_storage.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_secret_storage.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 9a34cee1bd81a6a9df028a5835c2b2cdb7a2982bb66c876324c66bb2df92d766
description: Storing and using secrets is one of the most sensitive actions taken by a developer to ensure the security of shopper information. A secret can be, and is not limited to, the following items.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Secret Storage in B2C Commerce

Storing and using secrets is one of the most sensitive actions taken by a developer to ensure the security of shopper information. A secret can be, and is not limited to, the following items.

- Credentials used to authenticate to remote services, such as username and password, API tokens, access tokens, and session IDs.
- Secret keys used to encrypt or decrypt sensitive data, such as private or symmetric keys.

Help prevent data exposure in a number of ways. First, make sure that sensitive data in forms isn’t logged or otherwise stored unless it’s absolutely necessary. Data that isn’t retained can’t be stolen. If you must store sensitive data, discard it as soon as possible and make sure that it’s encrypted. For credit card data, make sure that you use PCI Data Security Standard (DSS) compliant tokenization or truncation.

Use the following APIs to store secrets securely on Salesforce B2C Commerce.

- Service credentials
- Private keys
- Custom object attributes

## Service Credentials

For each web service, the framework requires a service configuration, service profile configuration, and service credential configuration. Create and manage these configurations in Business Manager.

Service credentials are accessible in B2C Commerce API as the `dw.svc.ServiceCredential` object. They are read-only. Never return them to a storefront request or write them into any logs.

## Private Keys

Cryptographic keys and certificates are pivotal resources for encryption and decryption, authentication, signatures, and more. To manage these keys and certificates, use the dedicated Business Manager wizard. They are accessible in the script API using the `CertificateRef` and `KeyRef` classes.

## Custom Object Attribute

To extend the B2C Commerce object model, use custom objects. Customize attributes, their respective fields, and properties of the custom object type.

Use type `PASSWORD` with any custom object attribute that handles secret information.