Thank you! What’s the best practice for tools where the upstream API only supports basic auth (username/password) and there’s no OBO option? In my case the log

Thank you! What’s the best practice for tools where the upstream API only supports basic auth (username/password) and there’s no OBO option? In my case the login returns a token that’s only valid for an hour, so the user has to re-auth after that. Do you stash the credentials on the MCP server and silently refresh, or is there a nicer pattern people are using?