Typically you would store the token in a configuration file in your program or web application. It's also good practice to encrypt the portion of the config file which contains sensitive information.
Note that you cannot hash the credentials because you need to be able to decrypt them back to plain text so you can pass them on.
As a side note, if your application is a website, the configuration file should not be publicly accessible (apache/IIS/etc will prevent that based on the file type), so in theory, if your web server is secure, many people feel they don't have to encrypt the sensitive portions of the config file. That being said, I almost always recommend it. It's pretty common for config files to be stored in source control which may have different levels of security access.