One person logs in once. Their profiles hold the credentials for third-party services, and any service that needs one asks keyring for a usable credential at the moment it needs it: a refreshed OAuth token, an API key, or the fields for a login form. No other service stores a secret, and no endpoint ever hands a stored secret back out.
What stands out
- OAuth consent flows and token refresh on behalf of a person
- Internal credential resolution for services acting for a person
- Master-key encryption at rest