Do: give clients scoped access to approved gateway routes, never broad provider credentials. Example: a fictional client config contains a gateway URL and client token but no provider key or unrestricted endpoint. Check: inspect the deployed client configuration and request logs; confirm the provider secret stays server-side and revocation can disable the client without changing provider credentials.