If I have to do an api call to an external service on beforesubmit (userevent script) - how do I safely store+use api keys?

Depending on your needs, you can hide the key in a custom record or script parameter and rely on restricted permissions