The credential every zPo authoring tool obtains the same way: client credentials when the deployment states a client, a browser sign-in with PKCE when it states none, and one resolver that decides which.