Obviously, I need a way to encrypt they keys so they're not accessible to the user running the program
Obviously, this is impossible.
Keys are just data. Software is just data. Everything is just data, and if the data is in someone else’s computer, you cannot prevent them from accessing the data! (It is just like writing something on a piece of paper and handing it to someone else – you cannot prevent them from reading it! The only exception is if you encrypt the data and do not give them access to the decryption key – but that will not help you here.)
The above discussion implies that you need to trust the user with the key. You cannot avoid this trust problem, but you may be able to shift it to a different target. Some hardware, such as Intel CPUs that support Software Guard Extensions, allows its owner to effectively hand control of the hardware back to the manufacturer, at least as far as the so-called “enclave” is concerned. If …
- you can convince the user to run your code in a supported enclave;
- you trust the manufacturer to keep their private key secret (which is a very big “if”, especially if the same key is used in every copy of the hardware);
- you use the corresponding public key to verify that the user is in fact using the enclave;
- you trust the manufacturer or your code to avoid side channel attacks (which is also a very big “if”, given that recent CPUs – including some designed with side channel attacks in mind – already have many known attacks); and
- you trust the manufacturer to make the enclave immune to any other software or hardware-based attacks (which is also a very big “if” given that the user has physical control over the hardware)
… then you shift the trust problem from the user to the manufacturer. In spite of all these caveats, some people seem to think enclaves are useful; technically, this is an answer to the question posed. But there are so many issues with it that it does not seem like a real answer.
In any case, your overall aim of creating a distributed bot that can post to your account sounds like a disaster waiting to happen. If you do not trust the volunteers to refrain from accessing your API keys, how can you trust them to, say, refrain from returning the kind of videos you do not want to be associated with? One answer is to use an enclave, with all of the caveats discussed above.
users can volunteer to run this program on their computer and take some of the load off my server
There might be an easier way of making this happen, which was hinted at in the EditVideoBot FAQ:
Where can I find the source code of the bot?
You can't, not yet at least. The main reason I haven't made it open source is because I don't know where I want to take this project in the future. I predict that I'll eventually make it open source, however.
Just do it. It is good for spreading the computing load among many computers. It is good for spreading the development effort among many developers. Most relevant to this site, it is good for security.