Application Key Manager

Application Key Manager allows administrators to securely store, manage, search, encrypt, and use external service keys. It can be used for reCAPTCHA, AI API keys, payment keys, webhook secrets, public site keys, and other integration credentials.

Use this feature when iBoard needs to store external service keys in a centralized and secure way instead of hardcoding them in pages, JavaScript, controllers, or configuration files.

Overview

Application Key Manager provides a secure key registry for application-level secrets and public keys. It supports key grouping, provider names, environment separation, key types, encrypted storage, public key access, server-side access, and token replacement inside managed templates or HTML content.

Search Filters

The Search Filters area helps administrators quickly find saved keys.

Summary Cards

Summary cards provide a quick overview of the current key registry.

Key List

The Key List table displays saved application keys. If no keys are registered, the system displays No application keys found.

Create Application Key

The Create Application Key screen is used to store external service keys securely. Secret values are encrypted before saving.

Basic Settings

When editing an existing key, leave Key Value empty if you want to keep the current saved value.

Key Types

Usage Guide

The Usage Guide explains how application keys can be created and used from server code, browser code, reCAPTCHA integration, security rules, and token replacement.

Basic Usage

1. Use filters to search saved keys.
2. Click Create Key to add a new key.
3. Click edit to update an existing key.
4. Use test if available to verify whether the encrypted key can be decrypted successfully.

Server Usage

Use IAppKeyProvider in services or controllers when you need to read key values internally.

Inject IAppKeyProvider

private readonly IAppKeyProvider _appKeyProvider;

public MyService(IAppKeyProvider appKeyProvider)
{
    _appKeyProvider = appKeyProvider;
}

Get a General Key Value

string apiKey = await _appKeyProvider.GetValueAsync("OPENAI_API_KEY", "PROD");

Get Google reCAPTCHA Site Key

string siteKey = await _appKeyProvider.GetGoogleRecaptchaSiteKeyAsync("PROD");

Get Google reCAPTCHA Secret Key

string secretKey = await _appKeyProvider.GetGoogleRecaptchaSecretKeyAsync("PROD");

Public Key Usage

Public key usage is intended for browser-safe keys only. The controller provides a public-key-only endpoint. It blocks SECRET keys and only returns keys whose Key Type is PUBLIC.

Controller Endpoint

/Admin/AppKeys/GetSiteKey?keyCode=GOOGLE_RECAPTCHA_SITE_KEY&environmentCode=PROD

JavaScript Example

async function loadSiteKey() {
    const response = await fetch("/Admin/AppKeys/GetSiteKey?keyCode=GOOGLE_RECAPTCHA_SITE_KEY&environmentCode=PROD");
    const result = await response.json();

    if (!result.success) {
        throw new Error(result.message || "Failed to load site key.");
    }

    return result.value;
}

Do not expose SECRET, TOKEN, payment secret, webhook secret, or AI API keys to JavaScript.

reCAPTCHA Enterprise v3 Example

For score-based reCAPTCHA Enterprise, the browser gets a token with grecaptcha.enterprise.execute, then the server verifies the token with Google Cloud Assessment API.

Required Keys

• GOOGLE_RECAPTCHA_SITE_KEY - Key Type: PUBLIC
• GOOGLE_RECAPTCHA_PROJECT_ID - Key Type: CONFIG
• GOOGLE_RECAPTCHA_API_KEY - Key Type: SECRET

Client Script Example

<script src="https://www.google.com/recaptcha/enterprise.js?render=SITE_KEY"></script>

const token = await grecaptcha.enterprise.execute(SITE_KEY, {
    action: "newsletter_subscribe"
});

Server Validation Concept

if (!tokenProperties.Valid) return false;
if (tokenProperties.Action != "newsletter_subscribe") return false;
if (riskAnalysis.Score < 0.5m) return false;

Security Notes

The controller clears cached key values after save, delete, or status change so updated keys can be used immediately.

Token Replacement

Token replacement is useful when a page is rendered from saved HTML, skin files, page builder content, or database-managed templates.

Basic Concept

Instead of writing the real key value directly in HTML, write a token pattern such as ##{GOOGLE_RECAPTCHA_SITE_KEY}##. During rendering, the server replaces the token with the actual value from the key manager.

HTML Template Example

<input type="hidden"
       id="NewsletterRecaptchaSiteKey"
       value="##{GOOGLE_RECAPTCHA_SITE_KEY}##" />

Rendered HTML Result

<input type="hidden"
       id="NewsletterRecaptchaSiteKey"
       value="actual-google-recaptcha-site-key" />

Server Replacement Example

string googleRecaptchaSiteKey =
    await _appKeyProvider.GetGoogleRecaptchaSiteKeyAsync("PROD");

result = result.Replace(
    "##{GOOGLE_RECAPTCHA_SITE_KEY}##",
    googleRecaptchaSiteKey ?? string.Empty
);

General Replacement Helper Example

private async Task<string> ReplaceAppKeyTokensAsync(string html)
{
    if (string.IsNullOrWhiteSpace(html))
    {
        return string.Empty;
    }

    string googleRecaptchaSiteKey =
        await _appKeyProvider.GetValueAsync("GOOGLE_RECAPTCHA_SITE_KEY", "PROD");

    string googleProjectId =
        await _appKeyProvider.GetValueAsync("GOOGLE_RECAPTCHA_PROJECT_ID", "PROD");

    html = html.Replace("##{GOOGLE_RECAPTCHA_SITE_KEY}##", googleRecaptchaSiteKey ?? string.Empty);
    html = html.Replace("##{GOOGLE_RECAPTCHA_PROJECT_ID}##", googleProjectId ?? string.Empty);

    return html;
}

Recommended Workflow

1. Open Admin > Site > AppKeys.
2. Click Create Key.
3. Enter a unique Key Code.
4. Enter a friendly Key Name.
5. Select Group, Provider, Environment, and Key Type.
6. Enter the Key Value.
7. Add a description explaining where the key is used.
8. Set Active if the key should be usable.
9. Click Save Key.
10. Use the key from server code, public endpoint, or token replacement depending on its type.

Common Use Cases

Important Notes

• SECRET values are encrypted before saving.
• Existing secret values are never displayed in plain text.
• Leave Key Value empty when editing if you want to keep the existing saved value.
• Use PUBLIC only for keys that are safe to expose to the browser.
• Never expose SECRET, TOKEN, payment secret, webhook secret, or AI API keys in JavaScript or HTML.
• Use separate environments such as DEV, TEST, and PROD.
• Rotate compromised or old keys immediately.

Troubleshooting

Best Practices

• Use clear key codes such as GOOGLE_RECAPTCHA_SITE_KEY or OPENAI_API_KEY.
• Keep provider names consistent, such as GOOGLE, OPENAI, STRIPE, or SENDGRID.
• Separate production and development keys by environment.
• Use SECRET for private credentials and PUBLIC only for browser-safe values.
• Document where each key is used in the Description field.
• Rotate sensitive keys regularly.
• Restrict access to this screen to trusted administrators only.

Application keys often control access to external services. Manage them carefully, protect secret values, and never expose private credentials to the browser.