You continue to do whatever it is you do now. This idea is just that the actual value of every secret token should be prefixed with a recognisable string. So

You continue to do whatever it is you do now. This idea is just that the actual value of every secret token should be prefixed with a recognisable string. So instead of your config file looking like: payment.api-key=sF1VGYGsJVnnb23a logging.api-key=yunHagrya It looks like: payment.api-key=secret-token:sF1VGYGsJVnnb23a logging.api-key=secret-token:yunHagrya Your code doesn't even need to change. It's just a convention used by parties issuing secret tokens, to make them easier to spot.