This is certainly an important question. We use a third-party vault to store tokens/keys.