What would be nice and idiomatic is to be able to something like:
(or something more configgy looking). This can be limited to the single secret case if needed (ie not username/password).
Using various incarnations of the wrapper:
You can, I think get credentials back out but it is seems less configgy for common scenarious.