A developer needs to call an authenticated external service. What is the correct credential principle?

1. Store the shared service password in a page variable
2. Include credentials in the public Git repository
3. Use supported protected authentication configuration rather than exposed client secrets
4. Put the secret into a URL query parameter