Before caveman login, wrap runs locally against your own provider login — no keys handed over. After login, requests go through the managed layer authenticated with your Caveman key and served with this project's stored provider credential (set below). No model-visible bytes change either way. Every teammate who logs in lands in Activity.