title: Securely store data in a Node CLI app
body: <p>I am currently writing a NodeJS command-line app. The app makes an API call and returns some data to the user. Given that this is a public API, the user requires an API token. This CLI will be installed globally on the user's machine via <code>npm i -g super-cool-api-cli</code>.</p>
  
  <p>The first time the user runs the CLI they are prompted for the token, and then I store it so that each subsequent time they run it they don't need to put it in. I have provided the user a way to reset it as well. I am storing it in the actual directory of my CLI module, which as stated is installed globally, and it looks something like this:</p>
  
  <pre><code>fs.writeFile( __dirname+'/.token.json', JSON.stringify( { "token": token }, null, 2 ), 'utf8', (e)=&gt;{
      // error handling and whatever
  });
  </code></pre>
  
  <p>I name the file <code>.token.json</code>, using a dot to at least make the file hidden by default. </p>
  
  <p>I guess what I am asking is if there is a better/more secure way of storing sensitive information in a NodeJS command line app, that you would be running more than once. I thought about using things like <a href="https://nodejs.org/api/process.html#process_process_env" rel="noreferrer">environment variables</a> but they seem to expire at the end of the process. </p>
  
  <p>Security considerations are a skill I somewhat lack, but greatly desire to learn more about, so thank you in advance for your tips.</p>