Ask HN: Best Practices for storing customer secrets?

For example, when making a SaaS application, what are the best practices for storing a customer secret, such as an API key?

Are there any security measures that can be implemented in case an attacker gains access to the database?