Process-wide cache of resolved AuthenticationTokenProvider instances keyed by a hash of the merged credential section content combined with the reference-identity hash of the resolver instance that produced the provider. Two callers with identical effective config that have the same resolver instance win for that section share one provider, so the token-layer cache inside the provider is also shared. Distinct resolver instances (even of the same type) get distinct cache entries — so a custom resolver carrying instance state (e.g., per-host secrets) cannot leak its provider into another caller's chain.