[ayi]

Deploying them as ENV values and reading from env is the best practice as far as I know. But "deploying" part depends on your infrastructure.

[securityquest]

Do you store them as plaintext in the backend db?

[tedyoung]

Often keys are stored in some sort of secure Key Vault. This is part of the infrastructure, e.g., Azure Key Vault. Or something like https://www.vaultproject.io/docs/secrets