I typically have such credentials in a config file, and have one config file for the sandbox and one for the production system.

Then I can either switch by host (ie one config file per host), or set a symlink, or have an environment variable or command line switch to chose one.

A config file also has the advantage that I don't need to put sensitive data under version control.