Best way to use service app with automation (e.g. GitHub Actions)?

[Aariq]

What's the best way to use boxr and a box service app on automated services like GitHub actions or a scheduled .Rmd doc on Posit Connect?

1. Storing the contents of the token text as a secret env var and passing it to box_auth_service(token_text = Sys.getenv(BOX_TOKEN_TEXT)
2. Storing a user client ID and secret as secret env vars BOX_CLIENT_ID and BOX_CLIENT_SECRET and then running box_auth_service()

Both work locally, but 1) "feels" more correct for automation, but I'm not sure which is best. Any advice?