We all know that when to store passwords, we should store it with one-way hash such as a variant of SHA, bcrypt or scrypt to prevent plain-text password leaks when the database is hacked.
But what about OAuth tokens? How should one store Facebook access token? Twitter access token? Should I store it as plain text? Encrypt it with AES and a site key? Or any more secure way to store it?
(Provided that the application requested only essential token scope from Facebook and the app have good reasons to store the token)