Where should a smart-glasses prototype keep service credentials?
Keep credentials out of public examples, screenshots and display payloads. A reusable service secret should not be embedded in client code that users can inspect. A backend can mediate access when the client cannot protect that secret.
Design around the credential's purpose
Give the prototype only the access needed for its current task and keep the secret separate from the content it sends to the glasses. Debug logs should explain success or failure without printing token values. This makes a demo easier to share without exposing access to the connected account or service.
If the display only needs a short answer, send that answer rather than the raw service response. The response may contain headers or identifiers useful for debugging but irrelevant to the wearer. Keep those concerns on the appropriate side of the application boundary.