Agree, i was going the vaultwarden route and figured this pattern seems better: https://fly.io/blog/tokenized-tokens/

Secrets are encrypted and the proxy decrypts on the fly if destination is whitelisted for that token.