If you store keys plaintext in the DB then if someone gets your DB then they're able to perform API requests on behalf on any of your users.