Where can we store 3rd party application passwords? I've written a Drupal 8 custom module that communicates with 3rd party APIs which need authentication. I have an application username and password for those APIs which I need to store somewhere. I can think of the following two ways to achieve that.


I can store the credentials in the Drupal database as configuration. But the password then becomes visible in plain text to all the site admins, and we don't want all the site admins to see the password (I also am aware that we can set up roles and permissions, so we can disable access to a particular configuration for all the site admins, but still the password is saved in plain text in the database). 
I can also store the credentials in the settings.php file. 


Is there any other way we can store these credentials? What is the best, secure and preferred way to store 3rd party account credentials in Drupal 8?
Yes, if you're looking for a Drupal-centric solution, the Key module might provide what you're looking for. It supports pulling your stored secrets from a few different locations:


Config
File
Environment Variable
3rd party services


As far a best, there's really no one-size-fits-all answer. It depends on your data storage requirements and what you're protecting (e.g. an API key for a medical records REST API should have heavy restrictions whereas a Slack webhook is pretty low risk).

If you're wanting a scalable solution, you might want to consider one of the many 3rd party services that provide secret management.