[twistedpair]

Should API access keys be stored in plain text such that they can easily be recovered from backups or clones to data warehouses?

Best practice would be to store such keys in an encrypted state, to prevent such breaches from non-production datasource access, or _even_ direct production database access.