Nice! I've built something like this, although specific to GitHub: https://github.com/denysvitali/gh-proxy

The idea being that if the fake token leaks from my sandbox - it would be completely useless for an attacker