CAPI has a lot of ways to do credentials and each provider can be slightly different.
We should have a best practices documentation entry, the idea would not be to 1:1 copy the CAPI/CAPx documentation, but rather best practices, like how we suggest to use it.