Best way to handle credentials for external services

Hi everyone,
I'm implementing a custom resource provider that creates a Project into an external service. That service exposes a set of APIs that requires a token to authenticate the API call. My schema is:

```yaml
{
"typeName": "Company::ExternalService::Project",
"description": "Create a project",
"additionalProperties": false,
"properties": {
"ProjectName": {
"description": "Name of the project",
"type": "string",
"pattern": "^[a-zA-Z0-9-_]{1,32}$"
},
"APIAccessToken": {
"description": "API Access token to authenticate with the API",
"type": "string"
},
"ProjectId": {
"description": "ID of the new project",
"type": "integer"
},
"CreationDate": {
"description": "Creation date of the project",
"type": "string"
}
},
"required": [
"ProjectName",
"APIAccessToken"
],
"readOnlyProperties": [
"/properties/ProjectId",
"/properties/CreationDate"
],
"primaryIdentifier": [
"/properties/ProjectId"
],
"handlers": {
"create": {
"permissions":[]
},
"read": {
"permissions": []
},
"delete": {
"permissions": []
},
"list": {
"permissions": []
}
}
}
```

To create a project I do the following:

```yaml
Resources:
ExternalServiceProject:
Type: Company::ExternalService::Project
Properties:
ProjectName: NewProjectName
APIAccessToken:

Ouputs:
ProjectId:
Value: !Ref ExternalServiceProject
ProjectCreationDate:
Value: !GetAtt ExternalServiceProject.CreationDate
```

The ExternalServiceProject physical resource id is "project$NewProjectName$