API keys should be stored securely to prevent unauthorized access. The best practice is to store them encrypted in a configuration file that is separate from the code. This approach ensures that sensitive information is not hardcoded in the source code, which could be exposed through version control or other means. Keeping API keys in encrypted configuration files also allows for better management and updating of keys without changing the application code.
Reference: Cisco Secure Coding Practices