I’m building an API integration product and need to store refresh tokens securely. What should I use?

For refresh tokens, the best default is:

Store them encrypted at rest using a dedicated secrets system or envelope encryption, with strict access controls.

Recommended options

1. Best if you can: use a secrets manager

   • Examples: AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, HashiCorp Vault
   • Pros: access control, auditing, rotation support, strong operational security
   • Good when token volume is moderate and you want managed security

2. If you store them in your own database: use application-level envelope encryption

   • Encrypt each refresh token before writing it to the DB
   • Use a KMS-managed data key or a dedicated encryption service
   • Store:
     • encrypted token
     • key identifier / version
     • metadata like provider, user, expiry, scopes
   • Never store refresh tokens in plaintext

What not to use

• Plaintext DB columns
• Weak or reversible hashing
  • Hashing is generally not useful because you need to present the refresh token back to the provider
• Client-side only protection
  • Not enough for backend storage

Security practices to apply

• Restrict access to the smallest possible service set
• Separate encryption keys from the database
• Rotate keys and support token re-encryption
• Log access attempts, not token values
• Mask tokens in traces, logs, and admin tools
• Use short-lived access tokens; keep refresh token use tightly scoped

Practical rule of thumb

• Single product / small scale: encrypted DB column with KMS envelope encryption
• More mature platform / higher security needs: secrets manager or Vault

If you want, I can recommend a concrete design for your stack (e.g. Postgres + AWS KMS, Node/Go/Python) and show the schema and encryption flow.