Three ways to let an AI agent call third-party APIs on behalf of a user

Store the token yourself, fetch it at runtime, or never hold it at all. Where the credential ends up in each pattern, what each one costs, and how to pick without guessing.