如何保护API密钥和第三方站点凭据（LAMP）？

I'm creating a site which will make use of ID's, Passwords, and API Keys to other 3rd party sites - for the server to access information accordingly. For the purpose of this conversation, let's assume it is for a payment gateway - meaning exposure of this information that is stored in the DB could mean a malicious user could withdraw cash from the account whose credentials were leaked.I'm creating a site which will make use of ID's