I don't think that's the usual meaning of security through obscurity, unless I'm misunderstanding you. It's sounds like you're saying that something like a sub

I don't think that's the usual meaning of security through obscurity, unless I'm misunderstanding you. It's sounds like you're saying that something like a substitution cypher, or even a one-time pad, would be security by obscurity, because they key is "obscure." My understanding is rather that security by obscurity means you're relying on the attacker not to have knowledge about you system -- e.g. that you have an admin backdoor at /s3cr3t-admin-pag3.html (real-world example), or that you can ping the server at an unpublished end point to get a token. The opposite of security by obscurity is when the entire structure of your system is a complete open book (e.g. everything is completely open sourced) except the password, and yet the system is sound enough to resist an attack. But note that possessing a "secret" (a password, a key, a one-time pad, the substitution rules, etc) doesn't mean it's now security by obscurity.