Keychain

The Keychain is Apple's system credential store — encrypted at rest, access-controlled by the OS, and able to require biometric authentication before an item is released.

For a tool holding provider API keys, storing them here rather than on a server is a materially different security model: a breach of the vendor cannot expose a key that was never on the vendor's infrastructure.

Items can be marked device-only and excluded from iCloud backup, so the credential never leaves the hardware. See Secure Enclave.