How do TF providers handle different type of access credentials?

Context: I'm working on a new TF Provider using SDKv2.

In my specific scenario, there's a set of the control plane resources that use type #1 of credentials (key / password) and then there's a different set of data plane resources that use type #2 of credentials (key / password). To be more explicit, user needs to specify both types of credentials (typically 1 set of credentials for control plane resources and N sets of credentials for data plane resources) to manage resources on both data plane and control plane.

Is there a pattern / way to manage it via TF Provider in a "smart" way? The core "issue" here is a user can initially provider 1x set of control plane credentials to manage control plane resources and then create data plane resources (as well as data plane credentials) so it's impossible to specify all of the credentials in a providers block.

The only solutions I'm aware of are:

1. Use separate providers for control plane resources and data plane resources to be able to pass credentials in providers block.

2. Introduce key / secret attributes as resource attributes for data plane resources (which is not ideal since we'll likely have to store credentials in TF state / or introduce some hacky workflow not to save them in TF state but it might trigger 401 / state drifts if we make a user delete them right after apply /read).

The idea here is I'd like to manage all the resources in the same TF Provider so option #1 doesn't pass this requirement.

Here's the minimal code example:

provider "foo" {
  control_plane_key = "111"
  control_plane_secret = "222"
}

# TF can manage both using control_plane_key & control_plane_secret
resource "control_plane_foo" "example" {}

# exports "endpoint" attribute
resource "control_plane_bar" "example2" {}

// exports "key" & "password" attributes
resource "data_plane_car_key" "example" {}
resource "data_plane_car" "example" {
   endpoint = control_plane_bar.example2.endpoint
   ...
   // needs data_plane key & password: data_plane_car_key.example.key & data_plane_car_key.example.password
}
resource "data_plane_car" "example2" {
   endpoint = control_plane_bar.example2.endpoint
   ...
   // needs data_plane key & password: data_plane_car_key.example.key & data_plane_car_key.example.password
}