Used locally to sign, never sent as-is and never stored. Issued with your tenant by CAKE Support.
SmartOTP signs nothing: these three go in the request body, and "Fill credentials" below writes them into it. They are backend credentials — proxy every call through your own Partner API rather than shipping them in an app.