I need to store API keys for my users. These keys are extremely valuable as they are used to buy and sell things. Some users won't want to give these keys to anyone, and I'm trying to figure out a better solution than simply storing them in a database.
It would be nice to some keep control of the key with the user. I consider making an open source script that they can deploy on a server and my app call or similar.
Somone suggested it might be possible to configure a proxy to do something without any code, but this is all beyond my expertise.
Does anyone have any other ideas?
edit: for further clarification
My system is a web app. Each user gives my system their api key, which allows the web app to trade on their behalf (buy and sell things). The essence of the system is that under certain automated circumstances the system will want to trade on the user's behalf.
I am considering a manual intervention with 2FA, which will likely be strong enough in my opinion, but is sub-optimal in that the user won't be able to react fast enough all of the time.
I consider creating some light-weight, open source, partner code that the user can deploy on their own server somewhere. The idea being that it can be independently verified as un-malicious and the user can store the keys themself.
I'm not sure if anything is gained by that approach besides a hacker having to find out the location of script, and even then if my server is compromised they can simply send trades using my system to this script in the same way as if everything was on my server.
I guess the idea of a proxy server would be something like the above, but something at a lower level than an app running on the server. I'm afraid I don't have enough server admin knowledge to speculate on how that might work.