This is how keychains should be designed. Never return the secret, but mint a new token, or sign a request.

We need this also for normal usage like development environments. Or when invoking a command on a remote server.

Are you going to add support for services that don't support OIDC or this going to be a known limitation?