Why Payment Credentials Are Write-Only (and How to Check Them)
After you save Stripe or Billplz credentials, the settings page never shows them back to you in full. This is deliberate, and it trips people up the first time they go looking for a "copy key" button that doesn't exist.
Why write-only
Secret API keys are sensitive enough that even an admin re-viewing them in plaintext is an unnecessary risk — a shoulder-surf, a screen share, a browser history entry. Once a credential is saved, the platform stores it and only ever uses it server-side to talk to the gateway. The UI has no code path that returns the full value.
The eye icon
Each saved credential row shows as On file with an eye icon next to it. Clicking the eye icon reveals a short, partial hint (for example, the last few characters) — enough to confirm you saved the key you think you saved, not enough to reconstruct it.
Clicking the eye icon shows a hint, not the full secret key.
If you need to change a key
You don't edit a masked field in place. Paste the new value over it and save — this overwrites the stored credential entirely. There's no "append" or "partial update" behavior.
Overwriting a saved credential replaces it outright; there's no way to recover the old value afterward.
Notes
If you've genuinely lost track of a key, regenerate it from the gateway's own dashboard (Stripe or Billplz) and paste the new one in — don't try to recover it from this platform.