On the topic of API access from NetSuite to an external server how are people securely managing credentials client secret, tokens etc.