API keys and client secrets are shown once and stored hashed. Rotate them if they leak; a revoked credential stops working immediately. You are responsible for calls made with your credentials.
Requests are rate limited per credential and answer 429 with a retry-after. Cache entitlement answers for the length of a session rather than per render.
Sign in with Shin ID gives you an identity and, with the entitlement scope, whether that person may use your product. It does not give you their library, their taste, or their address book, and there is no scope that does.
Signed, retried with backoff, and dead-lettered after repeated failure. Verify the signature and treat delivery as at-least-once: make your handler idempotent.