The Secret Value Store: keeping credentials out of your tables
A reusable AL pattern for storing API keys, client secrets, and access tokens so they never sit in a readable field — not on the card, not in the database, not over the API. Storage IsolatedStorage + SecretText Table role Write-only capture, never at rest On screen Masked, always Via API Unreachable — not a field 1. Why a text field is the wrong home for a secret Almost every setup table in a Business Central extension ends up needing to hold something sensitive — an API key, an OAuth client secret, a webhook signing token. The instinctive way to store it is a Text[250] field, maybe with ExtendedDatatype = Masked so it shows as dots on the card. That solves exactly one problem: what a user sees when the card is open. It does nothing about what SQL keeps, what a full-table export contains, or what an API page or query built on top of that table hands back to anyone with read access. Masking is a display property. The field underneath...