"If a plugin requires a secret such as an API token then it should be set in a variable that ends in TOKEN or SECRET, for example MY_TOKEN = 'some-secret-string'." . . . .