Our developer is planning a small internal integration with Epos Now. What is the recommended way to limit access to only the data and actions the application needs, store credentials securely, and rotate them without interrupting service?