Validate configuration and resolve all secret references eagerly so misconfiguration fails at startup.
options
Produce credentials for one scheme.
Whether credentials are configured for the scheme.
Forget cached credentials after the upstream rejected them.
Single upstream service identity loaded from the configuration.