Credentials are stored only in the backend (Supabase, accessed only by the server) and never reach the browser. Validation happens directly against Mercado Pago's official API (GET /users/me) — if the credentials are invalid, the real error returned by Mercado Pago appears here.