Issue and revoke service credentials. Secrets are generated server-side, hashed for storage, and revealed only once.