Currently, there's no way of changing a data source credentials programmatically, we do have a compliance requirement that requires rotating the secrets on in a while, and Retool always breaks until when we update it manually.
We now have Secrets Manager Integrations with AWS, GCP and Vault on the on-prem Enterprise plan in version 3.4+