Here are the best practices for storing API credentials that need to be configured by a subscriber's administrator in Salesforce:
1. **Use Protected Custom Settings**: Securely store credentials in protected custom settings, ensuring they are not accessible to unauthorized users or external packages. Provide a custom UI (e.g., Visualforce, Aura, or LWC) for administrators to input and manage these credentials.
2. **Use Named Credentials**: These allow secure packaging of metadata and configuration while letting the subscriber set up credentials post-installation. Note that administrators can view these credentials, so they are suitable for locally generated or per-org secrets.
3. **Encrypt and Store in Custom Objects**: If using custom objects, encrypt credentials with Salesforce's Apex Crypto methods. Store the encryption key in a protected custom setting or hidden custom metadata API field. Configure permissions to restrict access.
4. **Avoid Public Storage**: Do not store credentials in public custom settings, public custom objects, or public custom metadata, as these are accessible to other packages and untrusted code.
5. **Implement Secure Access Controls**: Restrict credential management to authorized users (e.g., administrators) and enforce proper CRUD/FLS checks in Apex code.
6. **Prevent Debug Log Exposure**: Ensure sensitive data like API credentials is not written to debug logs to avoid accidental exposure.
These practices help ensure the security and integrity of sensitive data within Salesforce.