Auth config
Providers, URLs, limits, hooks — secrets never shown
Refresh