Best Practice for Securely Storing OAuth Access Tokens in AEM as a Cloud Service

Hi everyone,

I'm looking for guidance on the recommended approach for securely storing OAuth access tokens in AEM as a Cloud Service.

We're evaluating different options for storing an access token that is used for outbound API integrations. The approaches we're considering include:

• In-memory cache: This avoids persistent storage, but since AEM as a Cloud Service runs multiple author/publish pods, each pod maintains its own cache. As a result, a pod without the token may need to perform an additional OAuth token request.
• JCR storage under /var: Store the encrypted access token under /var with appropriate ACLs and access it only through a dedicated service user.

I'd like to understand:

• Which of these approaches is generally recommended for AEM as a Cloud Service?
• Are there Adobe-recommended best practices for securely storing and managing OAuth access tokens?
• Has anyone implemented a different approach that works well in a cloud-native, multi-pod AEM environment?

Any guidance, recommendations, or references to Adobe documentation would be greatly appreciated.

Thank you!