Good question -- not in my case, but I think yes in a lot of other token auth cases. In my case I'm storing, per-user, a secret that I need to send to a third p

Good question -- not in my case, but I think yes in a lot of other token auth cases. In my case I'm storing, per-user, a secret that I need to send to a third party from time to time. The client isn't in the loop for these; they're async.