WordPress has no first-class way to store a credential. This proposal outlines a Secrets API for 7.2, along with WP-CLI support for it, and explains why the accompanying UI should wait for 7.3.
Why it matters
Every plugin that needs an API key today writes it to the options table in plaintext. That is the only available path, so this isn’t a criticism of plugin authors. The consequence is that credentials end up in the same table as the site tagline, and therefore in every database dump, every backup, every staging clone, and every wp option get in a shared
