Enable / disable third-party credentials. Keys are encrypted at rest. Disabling a flag does not remove the key.