A quick web search shows that storing them in a plist is not recommended. What are the best practices here?
What are best practices for storing API keys / access tokens?
What are the best practices here?
You will want to take a look at using the Keychain APIs. Here are some sample articles on storing Keys and Passwords in the Keychain:
Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com