Absolutely right to be cautious about storing sensitive token data in lookup tables, especially when visibility and job log exposure are a concern. A more secure and recommended approach in Workato is to use a combination of Encrypted Project Properties and the Workato Developer API. Here's how you can implement it:
Recommended Steps:
1. Use Encrypted Project Properties
Store your access token and expiry securely using project-level properties (set_project_property / get_project_property actions). These values are:
a. Encrypted at rest
b. Hidden in the UI once saved
c. Not exposed in job logs
2. Use the Workato Developer API
Programmatically read or update these properties securely via Workato’s Project Properties API. This is useful if token refresh logic is handled outside of Workato or needs to be triggered externally.
This Is Better:
1. Keeps token values fully hidden from users and logs.
2. Eliminates the need to store tokens in lookup tables.
3. Offers centralized, secure, and reusable token management.
While it adds a bit of initial setup effort, it greatly improves security and long-term scalability.
Quick Note: Instead of embedding refresh logic in every flow, centralize token management using a helper recipe or an external scheduler that updates the project property. Recipes calling the external API only need to read the current token securely, simplifying the logic and improving maintainability.
