You
Where should a local app keep an API key?
ChatGPT
In the OS keychain, through the platform API rather than a file you encrypt yourself. Any scheme where the app can decrypt the key without user interaction is obfuscation, so the honest choice is the keychain, and telling the user plainly that anything on their disk is readable by anything running as them.
You
Any downside worth knowing before I commit?
ChatGPT
It commits you to a format that is tedious to migrate away from later. The first weeks also look worse than doing nothing, which is when most people abandon it.