A secret has three addresses: the log, the file and the process — cheat sheet

log.info("syncing with %s", API)                 # the endpoint, never the credential
req = urllib.request.Request(API, headers={"Authorization": f"Bearer {token}"})
except urllib.error.HTTPError as e:
    log.error("the API refused the request: HTTP %s", e.code)   # not e.url, not str(e)

useradd --system --no-create-home --home-dir /nonexistent --shell /usr/sbin/nologin svc
passwd -l svc
chown svc:svc /etc/app/token && chmod 600 /etc/app/token
systemctl edit --force app.service        # a drop-in with [Service] User=svc
systemctl show app.service -p User -p Group --value
passwd -S svc                             # L = locked
journalctl _SYSTEMD_INVOCATION_ID=$(systemctl show app -p InvocationID --value)

Further, in the unit: DynamicUser=yes, LoadCredential=token:/etc/app/token, ProtectSystem=strict, NoNewPrivileges=yes, PrivateTmp=yes.