A company deploys a customer-facing agent UI. Which architecture keeps service credentials out of the browser?

1. The prompt instructs users not to inspect their browser network requests.
2. A hidden HTML input stores the token and sends it to every client.
3. An authenticated application backend calls the agent with appropriately scoped credentials.
4. A public frontend stores an administrator token in its bundled JavaScript.