Sensitive

The sensitive field keeps a stored secret, such as an API key, off the page. It renders a placeholder in place of the value, fetches the real value over AJAX only when it is revealed, and keeps the stored value when the form saves with the placeholder unchanged.

Masked value

When a value is stored, the password input holds __hidden__ rather than the secret. The eye button calls the field's onShowValue handler and shows the answer, and clicking it again masks the value. Typing clears the placeholder for a new value, and saving the form with the placeholder still in place keeps the stored value. With no value stored, the input starts empty and shows the field's placeholder.

hiddenPlaceholder changes the placeholder text, which is only ever compared with what the form posts, so pick something nobody would type as a real value.

The reveal handler returns the value to anyone who can load the form, so protect the page as you would the secret itself.

fields:
    api_key:
        label: API Key
        type: sensitive
        comment: The eye button reveals the stored key, and typing replaces it.

Copy button

allowCopy adds a button that copies the value to the clipboard. When the value has not been revealed yet, the button fetches it first, copies it, and masks it again.

fields:
    webhook_secret:
        label: Webhook Secret
        type: sensitive
        allowCopy: true
        comment: The copy button reveals the secret first when it has not been loaded yet.

Textarea mode

mode: textarea is for multi-line secrets, such as private keys. It shows a row of dots in place of the value, with Reveal Contents (and Copy to Clipboard, with allowCopy) below it. size sets the textarea height.

fields:
    private_notes:
        label: Private Notes
        type: sensitive
        mode: textarea
        allowCopy: true
        comment: Multi-line secrets stay behind a row of dots until revealed.

Read-only

A readOnly field disables the input but keeps the reveal and copy buttons, so the value can be looked at but not changed. The input posts nothing, so saving the form leaves the stored value alone. A disabled field behaves the same way.

fields:
    license_key:
        label: License Key
        type: sensitive
        readOnly: true
        comment: The key can be revealed, but not changed.

Hiding on tab change

A revealed value masks itself again when the browser tab is hidden, so it is not left on screen while you are away. hideOnTabChange: false leaves it revealed.

fields:
    access_token:
        label: Access Token
        type: sensitive
        hideOnTabChange: false
        comment: Stays revealed when you switch to another browser tab and back.

Options

Option	Description
mode	text for a password input, or textarea for a multi-line value. Default: text.
allowCopy	adds a button that copies the value to the clipboard. Default: false.
hiddenPlaceholder	the text the input holds in place of a stored value. Default: __hidden__.
hideOnTabChange	masks a revealed value when the browser tab is hidden. Default: true.

The field also takes the common field properties, such as placeholder, readOnly and disabled.