the token should be hidden by default in the UI with a reveal.