[web2py] Storing API credentials

[scausten]

I'm implementing PayPal on my site and would like to know the best
practice for securely storing my API credentials (user, pass,
signature).

Can this go in the database (say in a 'credentials' table), or should
it be elsewhere?