Passwords, API keys, and tokens are encrypted (AES-256) before they are saved.
When you sign up, Author's Toolbox creates a Master Key that lives only on your devices. Sign in on a new browser and you will be asked for your recovery key.
A few jobs cannot work that way. Sending email, and automations that run while you are away (such as email sequences), need the server to use the credential for that one job. A separate sealed copy is kept for that, and it is never shown to anyone.