Stuart Interview Question

In which files would you store API tokens, passwords, or similars?