We have a web application developed in Salesforce (apex classes/ triggers and visualforce pages). This web application is talking to our APIs externally using endpoint urls with username and password. As of right now these password/username and endpoint url are being stored in apex classes as constant strings.
In an ASP.Net application or something similar... we would usually store the credential/endpoint url in a web.config file. But in Salesforce where do we store these? I don't want these credential to be easily visible to anyone.