An HTTPS client for REST APIs whose API key, bearer token or password stays off the heap: the credential header is written from native memory into seclume's own TLS 1.3, request by request, and only ever to the one origin it belongs to. On its own, or as Spring's ClientHttpRequestFactory for RestClient and RestTemplate.