Does your package need the user to provide secrets, like API tokens, to work? Have you considered telling your package users about the keyring package, or even forcing them to use it?
The keyring package maintained by Gábor Csárdi is a package that acc…