+ Start a Discussion
Mike RochaMike Rocha 

Custom settings in managed package

I've poked around the forums and seen mention of this issue, but I have yet to come across a solution.
My application uses an authorization key stored in a protected custom setting to authenticate users to connect to an external web service. Since you can't define a default value on package install for a protected custom setting, I've created a post-installation class that manually sets the custom setting value via code.

The problem is, our security review results suggest that the key should not be stored in code in plain text. How can I go about setting the protected custom setting value if not from code? I'd rather not have the user do this manually.

Anyone have any suggestions?
James LoghryJames Loghry
Other than hard coding the key into your post install script, your next best option is to provide a custom visualforce page / visualforce tab where the user can enter the key.  The Visualforce tab would reside in the manage package and have access to write to the protected custom setting.   This still requires user intervention, but you could document it in your install instructions.