Storing Access and Refresh tokens with Sugar Cloud

What is the best way to store an access and refresh token for an external api in a way that will allow me to update them when new tokens are generated? I have a dashlet that accesses the Box API every time an Account record is refreshed. I want to make sure I can continue to use the access token while it is valid rather than getting a new access token every time the API is called.

Is there a directory in the file structure where I can store a txt or csv file to store the tokens? How is this typically handled?