AppSync HTTP Resolver: Storing credentials

For an AppSync HTTP Resolver / Data Source, is there a recommended approach to retrieve backend credentials that I need to access the source URL? (e.g. API tokens / Basic Authentication)

The only sensible thing I can find is this – https://advancedweb.hu/how-to-call-a-protected-external-api-using-appsync-http-data-source/ – but I'd rather not use that approach (rate limits, latency, KMS costs).

I'm now considering a lambda function that simply caches the credentials and use it as first part of a pipeline resolver, but that seems kinda hacky too.