Rudder

• The user asks for a new API token generation and enters some details
• The application displays a pop-up giving the token / secret / ... and warning about the fact that it will be displayed only once
• The user validates after copying the token and the token is created.

The token, after initial generation or renewal, is never displayed again and only known to the application itself and the user that created / renewed it. The only way to access it is to create another one or renew it, invalidating the first one.

This is a key security feature, preventing any impersonation of an API user (important especially when there is no read / write / read-write restriction for the tokens) and inviting users to create personal or project-related tokens instead of having everyone using the same easily accessible token, basically violating the non-repudiation paradigm.

We should do the same, by adding a pop-up at token creation / renewal with the "displayed only once" warning and never displaying the tokens.