Yea, I figured hashing them since they're essentially like passwords: if someone gets a copy, they can act with permissions of the real app on a user's data.

You figure I could replace the pbkdf2 work with single sha512 or something?