As an client: put it in the config or the database. The later if i have some sort of tenants or the api keys are not tied to the server. on the server: treat it as an password and show it only once.