# How to handle Credentials in Forge Apps

**URL:** <https://community.developer.atlassian.com/t/how-to-handle-credentials-in-forge-apps/43526>\
**Category:** Forge\
**Tags:** auth, secrets-management\
**Created:** [December 3, 2020, 10:22am UTC](https://community.developer.atlassian.com/t/how-to-handle-credentials-in-forge-apps/43526 "2020-12-03T10:22:28Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![ibuchanan](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/ibuchanan/32/35815_2.png) [@ibuchanan](https://community.developer.atlassian.com/u/ibuchanan)\
**Post date:** [September 7, 2021, 12:10pm UTC](https://community.developer.atlassian.com/t/how-to-handle-credentials-in-forge-apps/43526/3 "2021-09-07T12:10:02Z")

</div>

@anon69033679,

As long as the bearer token is appropriate a system token (for all users of the app), then the environment variable option fits. For example, with `client_credentials` for the app itself.

On the other hand, if you need per-tenant or per-user secrets, then you would want [the Forge secure storage feature](https://developer.atlassian.com/platform/forge/runtime-reference/storage-api/) just announced here:

> [@07 Sep 2021 - Forge CLI version 2.0.1 and Secure Storage API](https://community.developer.atlassian.com/t/07-sep-2021-forge-cli-version-2-0-1-and-secure-storage-api/51737):
>
> tada ADDED - linter support for the connectModules property to the Forge CLI To help support developers moving Connect apps to Forge, we have added linter support for the [connectModules](https://developer.atlassian.com/platform/forge/manifest-reference/#properties) property to the Forge CLI. tada ADDED - Forge Secure Storage API in @forge/api 2.3.0 We’re adding new APIs to the existing [Forge Storage API](https://developer.atlassian.com/platform/forge/runtime-reference/storage-api/) so that Forge apps now store secrets and credentials securely. Similar to storage.set, storage.get and storage.delete, the new APIs are storage.setSecret, storage.ge…

---

_[View the full topic](https://community.developer.atlassian.com/t/how-to-handle-credentials-in-forge-apps/43526)._
