Fetching App Credentials of a client

As per my understanding when a client integrates with 3rd party app, the client has to share the credentials with the 3rd party. Is there any other way that 3rd party can get the credentials via API or a callback hook?