Every connector has a manage page in Settings. You authorise it — OAuth where the vendor supports it, an API key where they do not — and the credential goes straight into the per-tenant vault. The connection row holds a reference, never the secret.
OAuth state is bound to the principal who started the flow, so a callback cannot be replayed by anyone else. Inbound webhooks are signature-verified before a single row is written, and a replayed webhook is recognised rather than processed twice.
Disconnecting is one action and it destroys the stored credential. There is no lingering token you have to remember to revoke at the other end.