If you develop in .Net, User Secrets. Best idea ever.

If you don’t, .env files with a proper .gitignore

Or AWS secrets manager, GitHub secrets, Azure KeyVault and inject them.

If you run on something like Azure, use Managed Identities. Passwords shouldn’t be used period. API keys should be securely injected in a pipeline from a vault.