That's easy to find out: change the API credentials of a user, but forget to update the service. Notice only a few days later that you forgot the change, but yo

That's easy to find out: change the API credentials of a user, but forget to update the service. Notice only a few days later that you forgot the change, but you also never got any notification "something" is going wrong. In contrast, every half-decent IdP will lock an account automatically after anything from 3-10 wrong attempts.