Hmm ig yeah I can be more granular.

Yeah we store our user credentials on our side and manage them. Along with refreshing tokens and so forth

This is horrifying. Everyone should be horrified.

I think they mean OAuth credentials (all these APIs use OAuth unless you're doing something terribly wrong).

Yep we're using Oauth, so it's easy for a user to disconnect.