You just don't inject the real secret unless hostname/whatever rule matches the request, right? I don't know if that's how this works but it's my assumption.
There's also an ability to create kits where you can setup credential injection into other services as well.