I am building a node.JS server which interacts with Microsoft APIs. The server deals with multiple applications created in Azure where each application will have a Client ID and Client secret configured. I have a logic that will switch between these credentials and query the appropriate Microsoft Application based on the organization of requesting user. My concern is about storing the Client id and Client secrets.
Initially, I had planned to store these in a YAML configuration file and read it, but then there can be Applications configured when server is running and also this method can't be efficient when the number of Applications configured is high.
My second option is to store these credentials in a database so that I can query them whenever needed, but this way, the person adding a new client might have to go through a learning curve to use database plus I do not want to expose my database passwords.
Is there a common practice to store a large number of sensitive application credentials like this?
You should look into dedicated secret storage. In Azure you can use the Azure Vault service for example. AWS has Secret Storage service, Google Cloud has Secret Manager.
If you use kubernetes for your deployment it has a built in cluster secret store.
You can also use a dedicated third party secret manager server / module such as Hashicorp Vault or Keywhiz from Square.