Where can we store 3rd party application passwords?
Yes, if you're looking for a Drupal-centric solution, the Key module might provide what you're looking for. It supports pulling your stored secrets from a few different locations:


Config
File
Environment Variable
3rd party services


As far a best, there's really no one-size-fits-all answer. It depends on your data storage requirements and what you're protecting (e.g. an API key for a medical records REST API should have heavy restrictions whereas a Slack webhook is pretty low risk).

If you're wanting a scalable solution, you might want to consider one of the many 3rd party services that provide secret management.