Both keys can do pretty much anything on the account.
The one difference being that the owner key can change the active key.
So put your owner key on your hardware wallet (trezor, ledger) or in Keybase for example.
Use your active key for everything else.
If there is ever a reason to suspect your active key has been compromised, use your owner key to create a new active key.
You can also do things like multi-sig your owner key so that more than one person has to sign for it to be able to change out the active key, or do other operations.
Here a detailed article very helpful :
https://medium.com/@bensig/how-to-change-eos-account-keys-6476d28b2728