If the web server is making API calls, encryption could still protect you from some SQL injection attacks, even if the decryption key for all tokens was in the

If the web server is making API calls, encryption could still protect you from some SQL injection attacks, even if the decryption key for all tokens was in the web app code. With a system of this scale, the web server will probably be making no API calls, as everything might be sent via some distributed system. There are, anyway, many solutions to store the keys, a key vault that is separate from both database and application/web servers would be ideal. There's not much to do if an attacker gains control of every machine, so the general idea is to keep every attack vector as isolated as possible.