Secret keys in plugins

[mariusandra]

Is your feature request related to a problem?

With plugins like the "github star sync plugin", I would like to give it my personal API key so it would get the data it needs, but I won't because then everyone in my team will see it and can read all my repositories.

There's a similar problem with auto generating personal API tokens in #2838 -- they should be "read once".

Describe the solution you'd like

I'd like a special configuration type secret (in addition to string and attachment), which would act as a "write-only" field.

Describe alternatives you've considered

Not leaking secret keys by not using the software.

Additional context

Thank you for your feature request – we love each and every one!

[yakkomajuri]

Yeah had just opened another issue before seeing this. I think we can add another field to each config input rather than type, like private or secret. Can be edited but never viewed.

[Twixes]

Something like "secret": true could be simple and versatile.

[yakkomajuri]

yup

[Twixes]

#3341 didn't entirely solve the security considerations regarding keeping secrets as secret as possible (encryption), but they're secret enough.