I have a script that will be making a call to an API and passing in an API key for authentication - what are the best practices for storing and using sensitive information? My first thought was a password field on a custom record, but now I'm wondering if there are better ways to do it

You can use password/encrypted fields that way, yes. Alternatively you can use Secrets. code sample

Secrets sounds like it'll be the best way to go, thanks Eric!