HttpClient uses strings, I like my sensitive data to not stay in memory for a random amount of time until the garbage collector decides it’s time to clean them up. (see the way the client_secret is handled).
If I’d done that I could just save it in plain text…