People that access critical info via API's, how do you deal with security concerns

Im curious how do you guys store your private keys for things like email client (mutt for example), git providers etc. I've heard things like storing the key on protected files or environment variables but none of those seem robust enough.