DEV Community

Cover image for What Is the Use of Encrypted KVM in Apigee X? (Interview Question with Practical Examples)
realNameHidden
realNameHidden

Posted on

What Is the Use of Encrypted KVM in Apigee X? (Interview Question with Practical Examples)

#apigee #google #apigeex #interview

Learn what Encrypted KVMs in Apigee X are, why they're used, how to access them securely, and how to answer this common Apigee interview question with practical examples.

Interviewer: "What is the use of Encrypted KVM in Apigee? How do you access encrypted KVM values when required?"

If you've attended an Apigee X interview, there's a good chance you've been asked this question.

Many candidates answer:

"Encrypted KVM is used to store passwords securely."

While that's technically correct, interviewers usually expect a much deeper explanation.

In this article, we'll cover:

  • What a KVM is
  • What makes an Encrypted KVM different
  • Why it is needed
  • How Apigee encrypts KVM values
  • How to access encrypted KVM values
  • A real-world payment API example
  • Common interview questions and answers
  • Best practices followed in production

Let's dive in.

Why Do We Need Encrypted KVMs?

Imagine you're developing a payment API.

Your proxy needs to call a backend service.

The backend requires Basic Authentication.

Username: payment-user
Password: MySuperSecretPassword123
Enter fullscreen mode Exit fullscreen mode

Where should you keep this password?

Option 1

var password = "MySuperSecretPassword123";
Enter fullscreen mode Exit fullscreen mode

❌ Very bad.

Everyone who can access the proxy bundle can read it.

Option 2

Store it in Java Callout source code.

Still bad.

Option 3

Store it inside JavaScript.

Still exposed.

Option 4

Store it inside an Encrypted KVM.

✅ Correct.

Only Apigee can decrypt it during runtime.

What is a KVM?

KVM stands for

Key Value Map

Think of it as a small secure dictionary.

Example

databaseUrl  → jdbc:mysql://server

timeout      → 30

currency     → INR

apiVersion   → v1
Enter fullscreen mode Exit fullscreen mode

Instead of hardcoding configuration inside proxies, we store it in a KVM.

This makes APIs easier to maintain.

What is an Encrypted KVM?

An Encrypted KVM stores sensitive values in encrypted form.

Examples include:

  • Database passwords
  • Backend credentials
  • API Secrets
  • Client Secrets
  • Private Keys
  • Third-party authentication tokens

Unlike a normal KVM:

password = welcome123
Enter fullscreen mode Exit fullscreen mode

An encrypted KVM stores something like:

password = A8FD92KSJH8237AJSHF...
Enter fullscreen mode Exit fullscreen mode

Even if someone accesses the datastore, they cannot read the original value.

Real-Life Analogy

Imagine two lockers.

Normal Locker

Anyone with the key can open it.

Locker

Password:
welcome123
Enter fullscreen mode Exit fullscreen mode

Encrypted Locker

The locker itself contains another encrypted safe.

Even after opening the locker,

you still cannot read the password.

Only Apigee knows how to decrypt it.

Locker

Encrypted Password

A8DKSHA87SHD8...
Enter fullscreen mode Exit fullscreen mode

That's exactly how Encrypted KVM works.

How Encryption Works 

              Create Encrypted KVM
                     |
                     |
             Store Password
                     |
                     |
          Apigee Encrypts Value
                     |
                     |
         Stored Inside Database
                     |
                     |
      Runtime Request Arrives
                     |
                     |
      Apigee Decrypts Automatically
                     |
                     |
          Policy Gets Original Value
Enter fullscreen mode Exit fullscreen mode

Notice something important.

You never decrypt the value yourself.

Apigee does it automatically.

How Do You Create an Encrypted KVM?

While creating the KVM,

simply enable

Encrypted = true
Enter fullscreen mode Exit fullscreen mode

Example

KVM Name

backend-config

Encrypted

true
Enter fullscreen mode Exit fullscreen mode

Then add entries

backendUser

payment-user

backendPassword

SuperSecretPassword
Enter fullscreen mode Exit fullscreen mode

Apigee encrypts

backendPassword
Enter fullscreen mode Exit fullscreen mode

before storing it.

How Do You Access an Encrypted KVM?

This is the interview's favorite question.

The answer is

Using the KeyValueMapOperations Policy.

Example

<KeyValueMapOperations name="KVM-Read">
    <Get assignTo="private.backendPassword">
        <Key>
            <Parameter>backendPassword</Parameter>
        </Key>
    </Get>

    <Scope>environment</Scope>

    <MapName>backend-config</MapName>
</KeyValueMapOperations>
Enter fullscreen mode Exit fullscreen mode

What happens?

Apigee

↓

Reads encrypted value

↓

Decrypts internally

↓

Stores original value into

private.backendPassword
Enter fullscreen mode Exit fullscreen mode

Now you can use

{private.backendPassword}
Enter fullscreen mode Exit fullscreen mode

inside the proxy.

Using the Value

Suppose your backend requires Basic Authentication.

You can create the Authorization header.

<AssignMessage name="CreateAuthHeader">

    <AssignVariable>

        <Name>request.header.Authorization</Name>

        <Template>

Basic {private.backendPassword}

        </Template>

    </AssignVariable>

</AssignMessage>
Enter fullscreen mode Exit fullscreen mode

Notice

We never manually decrypt anything.

Can JavaScript Read Encrypted KVM?

Yes.

After KeyValueMapOperations executes,

the decrypted value becomes available as a flow variable.

Example

var password = context.getVariable("private.backendPassword");

print(password);
Enter fullscreen mode Exit fullscreen mode

Again,

JavaScript never performs decryption.

Apigee already decrypted it.

Complete Flow 

                Client

                   |

                   |

          API Proxy Starts

                   |

                   |

     KeyValueMapOperations Policy

                   |

                   |

 Read Encrypted Password

                   |

                   |

Apigee Decrypts Automatically

                   |

                   |

 private.backendPassword

                   |

                   |

AssignMessage / JavaScript

                   |

                   |

 Call Backend

                   |

                   |

             Backend Response
Enter fullscreen mode Exit fullscreen mode

Real Production Example

Suppose your organization integrates with a payment gateway.

The gateway provides

Client ID

Client Secret

Username

Password
Enter fullscreen mode Exit fullscreen mode

Instead of

clientSecret = "123456789"
Enter fullscreen mode Exit fullscreen mode

store

gateway-config

clientSecret

username

password
Enter fullscreen mode Exit fullscreen mode

inside an encrypted KVM.

Whenever the API executes

Read KVM

↓

Decrypt

↓

Call Gateway
Enter fullscreen mode Exit fullscreen mode

No secret is exposed inside proxy code.

Why Not Store Secrets in JavaScript?

Suppose someone downloads the proxy bundle.

They immediately see

password = "welcome123"
Enter fullscreen mode Exit fullscreen mode

Huge security risk.

With Encrypted KVM

they only see

KVM Reference
Enter fullscreen mode Exit fullscreen mode

The actual value remains encrypted.

Common Interview Questions

Q1. What is the purpose of an Encrypted KVM?

To securely store sensitive information like passwords, API keys, client secrets, and tokens so they are not hardcoded in API proxies.

Q2. Can we read encrypted values directly?

No.

You read them using the KeyValueMapOperations policy.

Apigee automatically decrypts the value during runtime.

Q3. Can JavaScript decrypt an encrypted KVM?

No.

JavaScript cannot decrypt it.

It can only access the already decrypted flow variable after the KVM policy executes.

Q4. Can we view encrypted values from the UI?

No.

Once stored, encrypted values cannot be viewed in plain text.

You can update them, but you cannot retrieve the original value.

Q5. Should certificates be stored in KVM?

No.

Certificates and private keys should be stored in Keystores and Truststores.

KVMs are intended for configuration values and secrets such as passwords or API credentials.

Best Practices

✅ Store only sensitive values in Encrypted KVMs.

✅ Use environment-scoped KVMs so each environment (dev, test, prod) can have different secrets.

✅ Never hardcode passwords, API keys, or client secrets in JavaScript or proxy XML.

✅ Use meaningful KVM names such as backend-config, payment-config, or oauth-config.

✅ Restrict permissions so only authorized administrators can update encrypted KVM entries.

Common Mistakes

❌ Hardcoding credentials in JavaScript.

❌ Logging decrypted secrets in MessageLogging or JavaScript.

❌ Using a plain KVM for passwords or client secrets.

❌ Storing certificates in a KVM instead of a Keystore.

❌ Sharing the same secret across all environments.

Interview Answer (2-Minute Version)

Encrypted KVMs in Apigee X are used to securely store sensitive configuration data such as backend passwords, client secrets, API keys, and authentication tokens. Unlike a normal KVM, the values are encrypted before being stored, which prevents them from being exposed to administrators or developers. During API execution, the KeyValueMapOperations policy reads the encrypted value, and Apigee automatically decrypts it and stores it in a flow variable. The proxy or JavaScript then accesses the flow variable without performing any manual decryption. This approach eliminates hardcoded secrets from API proxies and follows security best practices for enterprise API management.

Key Takeaways

  • Encrypted KVMs protect sensitive configuration data.
  • Apigee performs encryption and decryption automatically.
  • Access encrypted values using the KeyValueMapOperations policy.
  • JavaScript reads the decrypted flow variable—it never decrypts the value itself.
  • Use Encrypted KVMs for secrets, and Keystores/Truststores for certificates.

Learn More

Did this help?

Have you been asked this question in an Apigee interview? Share your experience or drop your questions in the comments.

If you found this guide useful, follow me for more Apigee X, API Management, and API Security interview-focused articles.

Top comments (0)