The old answer used to be in a custom setting. That is simple, but the secrets are stored in plaintext and readable by anyone who has access to the custom setting.
If you're writing a managed package, you can go better by making it a private custom setting (in this sense, private means only readable within the package that defines the setting). Then, your code in the package can read the secrets in order to make the callout, but no-one else can read them. Obviously, you need to write a VF page (or some Apex setter method) in your package to allow users to set the secret values in the first place.
There is also the relatively new feature of Named Credentials. I haven't actually used these, but they seem to be SF's latest thinking on how to solve this problem. They bundle together the endpoint and the credentials so that your callout code is simpler. More details here: https://help.salesforce.com/articleView?id=named_credentials_about.htm&type=0&language=en_US
As for your error message: To help with that, it would be useful if you posted the relevant code.