&gt; Best practice is to avoid storing secrets in plaintext<p>How do you store them, then? If they&#x27;re encrypted with a password, how do you store <i>that</i> secret?<p>I&#x27;m pretty sure best practice is in fact to store things like SSL private keys, cookie HMAC secrets (e.g. Django&#x27;s SECRET_KEY), and so forth on local disk unencrypted, protected by only filesystem permissions (and the host OS as a whole protected with standard means). In fact I&#x27;m not even sure it&#x27;s possible to store OpenSSH private keys unencrypted.<p>&gt; or sharing secrets between users&#x2F;roles.<p>There&#x27;s only one role here: the application that has an API key. There are multiple developers of that application, and possibly multiple instances of that application, but it&#x27;s a single role.