Not sure what you mean by "API keystroke passwords". Almost all major APIs these days that you'd be working with for your bot use either OAUTH, generated API token strings, or bot. So you're either storing an OAUTH token or a token that isn't OAUTH but that the user treats a lot like a simple OAUTH token (it is use-case-specific, can be revoked, is identified by its purpose, etc)