The key is always stored in the database

The key is always stored within the config file on the Application Server

The key can either be stored in the database, in the config file on the Application Server, or in a separate securable file on the Application Server

The key is hard-coded and stored securely within the Application. It is subjected to obfuscation to ensure it's protection

The key can only be stored in the database or in the config file on the Application Server