On iOS I store that info in the keychain. In database I believe it is usually stored in plain text as the user can at anytime remove access to the credentials on the 3rd party's site.