Should be delegated to OS when possible, but we haven't really figured out the _how_ yet. IntelliJ is the exception since they have their own credentials management system.