Currently API keys are stored in 'plain text'. This is bad.
There was a WIP patch for this on the old repo.