The Move This Engine Will Not Make
A coding engine that wants every brain available will feel the pull to become a login app. Device codes, redirect URIs, a client id of its own, a consent screen that says a family name. That path is a standing refusal. Firebrand never runs a parallel authorization. It never impersonates a vendor's client. It never copies a credential out of a store to pretend it is someone else.
What it may do is continue a session the operator already opened with the vendor's own login. The only OAuth operation under the legs is a refresh-token grant, under the client id the vendor's own token already names. The write-back is atomic, unknown fields are preserved, and a reused or rotated refresh is re-read once, retried once, then surfaced as 'go run their login again.' A transport failure mid-refresh is not blindly retried when the vendor rotates refresh tokens.
Keys Are Narrower Than They Look
Some brains have a documented third-party API key. Those legs use that key, with a truthful client identifier, and nothing else. The credential-plus-fake-user-agent path is the same refusal wearing a different shirt. Keys resolve lazily from the environment, then from an operator secrets file, only when a leg names them. They stay on the leg instance. They are not exported into a child's environment. Doctor prints the resolved source by name and never prints a value.
Usage Is the One Narrow Read
Two subscription brains have a quota worth watching. One is asked through that vendor's own local app-server, so no credential is read at all. The other is a declared amendment: a read-only look at a usage endpoint using a token the operator already has, no write, no refresh, no inference spend, truthful user agent. The paid inference API stays banned. A stale token is reported, never repaired.