Secrets update

I'm building a platform where company managers can connect their own clearing (via sumit). This is done through their API. When I request the API with their details, I get back API keys that I need to keep secret. As far as I understand, it's not safe to keep this data at all except as a secret. What's the best way to do this? Is there an option to create a secret in the backend function?