I am having to refactor a Quickbooks integration with Salesforce and am wondering the best way to store the credential information. The first developer used custom settings for most of the credentials and a field on the user object for the access token (since it is more than 255 characters). I need to move the access token elsewhere so that it is not stored in plain text but I would like to be able to easily access it from Apex code. The access token seems to be around 700 characters. Any and all advice is appreciated.
Store it on a
Named Credential. It has an OAuthToken field which you can merge into your callouts without ever needing to know its value. And in fact you won't be able to read the value after you set it.
Using the token is easy. Setting it took a little more work. You can see some more about what I did with a similar requirement here.