Most systems let a program authenticate with a long random string: an API token. Whoever holds the string is the program, as far as the system is concerned. These are called bearer credentials, because bearing them is enough. A bus ticket works the same way: it does not care who is holding it.
Bearer tokens are convenient and they are also the exact problem a secrets manager exists to solve. A token sitting in a CI variable is a long-lived secret on a disk: the very thing you adopted the tool to stop doing. Worse, if it leaks, it works for anyone, from anywhere, until someone notices.
So this tool has none. Every participant, every person and every machine alike, is a keypair. Proving who you are means signing a fresh challenge with your private key, which never travels. There is nothing on the wire that an eavesdropper can reuse, and nothing in the server's storage worth stealing.