Where should a local app keep an API key

In the OS keychain, through the platform API rather than a file you encrypt yourself. Any scheme where the app can decrypt the key without user interaction is obfuscation, so the honest choice is the keychain, and telling the user plainly that anything on their disk is readable by anything running as them.