I'm somewhat new to data encryption/safety, but I already read about basic concepts like hashing passwords, encrypting files, etc. If possible, please ELI5 - thanks in advance.
Background: my application interacts with a third party (Twitch) using an OAuth key for IRC as well as a Client ID. Both of these can be used to effectively access the application's Twitch account and do anything with it. The keys are sent as plaintext whenever the application establishes a connection with the Twitch servers (which I can't do anything about and it's not really that huge of a problem). My main security concern is about someone getting access to the user's computer and stealing the keys from there.
I'd like to securely store these on the disk so that the user doesn't have to log into Twitch every time they open the application (to retrieve the keys). To do this, my best solution so far was to encrypt the file containing them. The obvious way to do this would be to require a password when the application starts, then use a stored hash+salt to check that password, and use the password (or its hash with a different salt) as a key to decrypt the file.
As said before, I'm new to data protection, so there might be a much better way to do this. Please do suggest one if there is one. However, as for this...
If possible, I'd also like to not have the user enter their password every time they open the application - simply for user convenience. Prompting the password once per user session (or once every time the computer is restarted) seems reasonable.
I thought about doing this by storing something in RAM, or perhaps by storing some kind of hash as a temporary file. However, I haven't been able to come to an actual conclusion yet. Maybe I'm asking for too much. Nevertheless, is there an actual, decent way to implement this? If not, is prompting for a password on every application startup a better idea than going about storing those Twitch keys securely in some other way?
If it matters - for my specific case, I'm using Python 3.7, and I aim to make my application cross-platform (as long as the system supports Python).