From fbbf201317b7561d30f9ff9945dac65e7cf7a1d8 Mon Sep 17 00:00:00 2001
From: Franck Nijhof <git@frenck.dev>
Date: Wed, 30 Sep 2026 19:34:50 +0200
Subject: [PATCH] Mark CONF_TOKEN as secret in credential schemas (#183796)

---
 homeassistant/components/cisco_webex_teams/notify.py    | 2 +-
 homeassistant/components/discogs/config_flow.py         | 2 +-
 homeassistant/components/discogs/sensor.py              | 2 +-
 homeassistant/components/enphase_envoy/config_flow.py   | 2 +-
 homeassistant/components/foobot/sensor.py               | 2 +-
 homeassistant/components/fortios/device_tracker.py      | 2 +-
 homeassistant/components/gatus/config_flow.py           | 4 ++--
 homeassistant/components/geniushub/config_flow.py       | 2 +-
 homeassistant/components/gitlab_ci/sensor.py            | 2 +-
 homeassistant/components/growatt_server/config_flow.py  | 4 ++--
 homeassistant/components/hyperion/config_flow.py        | 2 +-
 homeassistant/components/influxdb/config_flow.py        | 2 +-
 homeassistant/components/influxdb/const.py              | 2 +-
 homeassistant/components/karakeep/config_flow.py        | 6 ++++--
 homeassistant/components/lifx_cloud/scene.py            | 2 +-
 homeassistant/components/music_assistant/config_flow.py | 8 ++++++--
 homeassistant/components/notify_events/__init__.py      | 6 +++++-
 homeassistant/components/ntfy/config_flow.py            | 4 ++--
 homeassistant/components/nuki/config_flow.py            | 6 +++---
 homeassistant/components/nyt_games/config_flow.py       | 4 +++-
 homeassistant/components/otp/config_flow.py             | 2 +-
 homeassistant/components/overkiz/config_flow.py         | 2 +-
 homeassistant/components/plaato/config_flow.py          | 4 +++-
 homeassistant/components/ruuvi_gateway/schemata.py      | 2 +-
 homeassistant/components/sanix/config_flow.py           | 2 +-
 homeassistant/components/splunk/config_flow.py          | 8 +++++---
 homeassistant/components/switcher_kis/config_flow.py    | 2 +-
 homeassistant/components/syncthing/config_flow.py       | 2 +-
 homeassistant/components/system_bridge/config_flow.py   | 4 ++--
 homeassistant/components/tailwind/config_flow.py        | 8 ++++----
 homeassistant/components/todoist/calendar.py            | 2 +-
 homeassistant/components/todoist/config_flow.py         | 2 +-
 homeassistant/components/wattwaechter/config_flow.py    | 6 +++---
 homeassistant/components/xiaomi_miio/config_flow.py     | 4 +++-
 homeassistant/components/xiaomi_miio/device_tracker.py  | 2 +-
 homeassistant/components/xiaomi_miio/remote.py          | 2 +-
 homeassistant/components/zwave_me/config_flow.py        | 4 ++--
 37 files changed, 71 insertions(+), 53 deletions(-)

diff --git a/homeassistant/components/cisco_webex_teams/notify.py b/homeassistant/components/cisco_webex_teams/notify.py
index 6e06b9e7ed1c..4664c5a29d26 100644
--- a/homeassistant/components/cisco_webex_teams/notify.py
+++ b/homeassistant/components/cisco_webex_teams/notify.py
@@ -22,7 +22,7 @@ CONF_ROOM_ID = "room_id"
 
 PLATFORM_SCHEMA = NOTIFY_PLATFORM_SCHEMA.extend(
     {
-        probatio.Required(CONF_TOKEN): cv.string,
+        probatio.Required(probatio.Secret(CONF_TOKEN)): cv.string,
         probatio.Required(CONF_ROOM_ID): cv.string,
     }
 )
diff --git a/homeassistant/components/discogs/config_flow.py b/homeassistant/components/discogs/config_flow.py
index 8e084e7721f8..d7ad7da4726b 100644
--- a/homeassistant/components/discogs/config_flow.py
+++ b/homeassistant/components/discogs/config_flow.py
@@ -14,7 +14,7 @@ from .const import DOMAIN, LOGGER
 
 CONFIG_SCHEMA = probatio.Schema(
     {
-        probatio.Required(CONF_TOKEN): str,
+        probatio.Required(probatio.Secret(CONF_TOKEN)): str,
     }
 )
 
diff --git a/homeassistant/components/discogs/sensor.py b/homeassistant/components/discogs/sensor.py
index e7f0bd1a93d1..d4e4b085992a 100644
--- a/homeassistant/components/discogs/sensor.py
+++ b/homeassistant/components/discogs/sensor.py
@@ -62,7 +62,7 @@ SENSOR_KEYS: list[str] = [desc.key for desc in SENSOR_TYPES]
 
 PLATFORM_SCHEMA = SENSOR_PLATFORM_SCHEMA.extend(
     {
-        probatio.Required(CONF_TOKEN): cv.string,
+        probatio.Required(probatio.Secret(CONF_TOKEN)): cv.string,
         probatio.Optional("name"): cv.string,
         probatio.Optional("monitored_conditions"): probatio.All(
             probatio.EnsureList(), [cv.string]
diff --git a/homeassistant/components/enphase_envoy/config_flow.py b/homeassistant/components/enphase_envoy/config_flow.py
index a0a601b2bfce..e6e2f5121065 100644
--- a/homeassistant/components/enphase_envoy/config_flow.py
+++ b/homeassistant/components/enphase_envoy/config_flow.py
@@ -152,7 +152,7 @@ class EnphaseConfigFlow(ConfigFlow, domain=DOMAIN):
 
         if self.manual_token:
             # in manual token entry mode show token input field
-            schema[probatio.Optional(CONF_TOKEN, default="")] = str
+            schema[probatio.Optional(probatio.Secret(CONF_TOKEN), default="")] = str
         else:
             # in automatic token mode show username and password inputs
             schema[
diff --git a/homeassistant/components/foobot/sensor.py b/homeassistant/components/foobot/sensor.py
index 13c355a00129..51aa66173b2f 100644
--- a/homeassistant/components/foobot/sensor.py
+++ b/homeassistant/components/foobot/sensor.py
@@ -84,7 +84,7 @@ TIMEOUT = 10
 
 PLATFORM_SCHEMA = SENSOR_PLATFORM_SCHEMA.extend(
     {
-        probatio.Required(CONF_TOKEN): cv.string,
+        probatio.Required(probatio.Secret(CONF_TOKEN)): cv.string,
         probatio.Required(CONF_USERNAME): cv.string,
     }
 )
diff --git a/homeassistant/components/fortios/device_tracker.py b/homeassistant/components/fortios/device_tracker.py
index 7b33d839493e..926ecc75ef35 100644
--- a/homeassistant/components/fortios/device_tracker.py
+++ b/homeassistant/components/fortios/device_tracker.py
@@ -27,7 +27,7 @@ DEFAULT_VERIFY_SSL = False
 PLATFORM_SCHEMA = DEVICE_TRACKER_PLATFORM_SCHEMA.extend(
     {
         probatio.Required(CONF_HOST): cv.string,
-        probatio.Required(CONF_TOKEN): cv.string,
+        probatio.Required(probatio.Secret(CONF_TOKEN)): cv.string,
         probatio.Optional(CONF_VERIFY_SSL, default=DEFAULT_VERIFY_SSL): cv.boolean,
     }
 )
diff --git a/homeassistant/components/gatus/config_flow.py b/homeassistant/components/gatus/config_flow.py
index 471252d200a1..f18ff549a64f 100644
--- a/homeassistant/components/gatus/config_flow.py
+++ b/homeassistant/components/gatus/config_flow.py
@@ -43,7 +43,7 @@ STEP_USER_DATA_SCHEMA = probatio.Schema(
                 autocomplete="current-password",
             ),
         ),
-        probatio.Optional(CONF_TOKEN): TextSelector(
+        probatio.Optional(probatio.Secret(CONF_TOKEN)): TextSelector(
             TextSelectorConfig(
                 type=TextSelectorType.PASSWORD,
             ),
@@ -209,7 +209,7 @@ class GatusConfigFlow(ConfigFlow, domain=DOMAIN):
                         autocomplete="current-password",
                     ),
                 ),
-                probatio.Optional(CONF_TOKEN): TextSelector(
+                probatio.Optional(probatio.Secret(CONF_TOKEN)): TextSelector(
                     TextSelectorConfig(
                         type=TextSelectorType.PASSWORD,
                     ),
diff --git a/homeassistant/components/geniushub/config_flow.py b/homeassistant/components/geniushub/config_flow.py
index 6a999ef2e395..7ba66204a07f 100644
--- a/homeassistant/components/geniushub/config_flow.py
+++ b/homeassistant/components/geniushub/config_flow.py
@@ -19,7 +19,7 @@ _LOGGER = logging.getLogger(__name__)
 
 CLOUD_API_SCHEMA = probatio.Schema(
     {
-        probatio.Required(CONF_TOKEN): str,
+        probatio.Required(probatio.Secret(CONF_TOKEN)): str,
     }
 )
 
diff --git a/homeassistant/components/gitlab_ci/sensor.py b/homeassistant/components/gitlab_ci/sensor.py
index a5ea3bd7ce17..9db1e1085dd0 100644
--- a/homeassistant/components/gitlab_ci/sensor.py
+++ b/homeassistant/components/gitlab_ci/sensor.py
@@ -44,7 +44,7 @@ SCAN_INTERVAL = timedelta(seconds=300)
 PLATFORM_SCHEMA = SENSOR_PLATFORM_SCHEMA.extend(
     {
         probatio.Required(CONF_GITLAB_ID): cv.string,
-        probatio.Required(CONF_TOKEN): cv.string,
+        probatio.Required(probatio.Secret(CONF_TOKEN)): cv.string,
         probatio.Optional(CONF_NAME, default=DEFAULT_NAME): cv.string,
         probatio.Optional(CONF_URL, default=DEFAULT_URL): cv.string,
     }
diff --git a/homeassistant/components/growatt_server/config_flow.py b/homeassistant/components/growatt_server/config_flow.py
index 5288937b4f19..0f55114e1e9a 100644
--- a/homeassistant/components/growatt_server/config_flow.py
+++ b/homeassistant/components/growatt_server/config_flow.py
@@ -203,7 +203,7 @@ class GrowattServerConfigFlow(ConfigFlow, domain=DOMAIN):
         elif auth_type == AUTH_API_TOKEN:
             data_schema = probatio.Schema(
                 {
-                    probatio.Required(CONF_TOKEN): str,
+                    probatio.Required(probatio.Secret(CONF_TOKEN)): str,
                     probatio.Required(
                         CONF_REGION, default=current_region
                     ): SelectSelector(
@@ -349,7 +349,7 @@ class GrowattServerConfigFlow(ConfigFlow, domain=DOMAIN):
         """Show the API token form to the user."""
         data_schema = probatio.Schema(
             {
-                probatio.Required(CONF_TOKEN): str,
+                probatio.Required(probatio.Secret(CONF_TOKEN)): str,
                 probatio.Required(CONF_REGION, default=DEFAULT_URL): SelectSelector(
                     SelectSelectorConfig(
                         options=list(SERVER_URLS_NAMES.keys()),
diff --git a/homeassistant/components/hyperion/config_flow.py b/homeassistant/components/hyperion/config_flow.py
index d8ca079a1223..65f4bc942996 100644
--- a/homeassistant/components/hyperion/config_flow.py
+++ b/homeassistant/components/hyperion/config_flow.py
@@ -321,7 +321,7 @@ class HyperionConfigFlow(ConfigFlow, domain=DOMAIN):
             data_schema=probatio.Schema(
                 {
                     probatio.Required(CONF_CREATE_TOKEN): bool,
-                    probatio.Optional(CONF_TOKEN): str,
+                    probatio.Optional(probatio.Secret(CONF_TOKEN)): str,
                 }
             ),
             errors=errors,
diff --git a/homeassistant/components/influxdb/config_flow.py b/homeassistant/components/influxdb/config_flow.py
index 8dddefc847b2..0cc2ea0bcc31 100644
--- a/homeassistant/components/influxdb/config_flow.py
+++ b/homeassistant/components/influxdb/config_flow.py
@@ -102,7 +102,7 @@ INFLUXDB_V2_SCHEMA = probatio.Schema(
                 type=TextSelectorType.TEXT,
             ),
         ),
-        probatio.Required(CONF_TOKEN): TextSelector(
+        probatio.Required(probatio.Secret(CONF_TOKEN)): TextSelector(
             TextSelectorConfig(
                 type=TextSelectorType.PASSWORD,
             ),
diff --git a/homeassistant/components/influxdb/const.py b/homeassistant/components/influxdb/const.py
index f8b1a0275071..40b27dc371fd 100644
--- a/homeassistant/components/influxdb/const.py
+++ b/homeassistant/components/influxdb/const.py
@@ -150,7 +150,7 @@ COMPONENT_CONFIG_SCHEMA_CONNECTION = {
     probatio.Inclusive(CONF_PASSWORD, "authentication"): cv.string,
     probatio.Optional(CONF_DB_NAME, default=DEFAULT_DATABASE): cv.string,
     # Connection config for V2 API only.
-    probatio.Inclusive(CONF_TOKEN, "v2_authentication"): cv.string,
+    probatio.Inclusive(probatio.Secret(CONF_TOKEN), "v2_authentication"): cv.string,
     probatio.Inclusive(CONF_ORG, "v2_authentication"): cv.string,
     probatio.Optional(CONF_BUCKET, default=DEFAULT_BUCKET): cv.string,
 }
diff --git a/homeassistant/components/karakeep/config_flow.py b/homeassistant/components/karakeep/config_flow.py
index 7b8b8ab06819..cb7f5d3befb3 100644
--- a/homeassistant/components/karakeep/config_flow.py
+++ b/homeassistant/components/karakeep/config_flow.py
@@ -25,11 +25,13 @@ _LOGGER = logging.getLogger(__name__)
 STEP_USER_DATA_SCHEMA = probatio.Schema(
     {
         probatio.Required(CONF_URL): str,
-        probatio.Required(CONF_TOKEN): str,
+        probatio.Required(probatio.Secret(CONF_TOKEN)): str,
         probatio.Required(CONF_VERIFY_SSL, default=DEFAULT_VERIFY_SSL): bool,
     }
 )
-STEP_REAUTH_DATA_SCHEMA = probatio.Schema({probatio.Required(CONF_TOKEN): str})
+STEP_REAUTH_DATA_SCHEMA = probatio.Schema(
+    {probatio.Required(probatio.Secret(CONF_TOKEN)): str}
+)
 
 
 class KarakeepConfigFlow(ConfigFlow, domain=DOMAIN):
diff --git a/homeassistant/components/lifx_cloud/scene.py b/homeassistant/components/lifx_cloud/scene.py
index 6efb8a433fe2..d12d58d03573 100644
--- a/homeassistant/components/lifx_cloud/scene.py
+++ b/homeassistant/components/lifx_cloud/scene.py
@@ -27,7 +27,7 @@ DEFAULT_TIMEOUT = 10
 PLATFORM_SCHEMA = probatio.Schema(
     {
         probatio.Required(CONF_PLATFORM): "lifx_cloud",
-        probatio.Required(CONF_TOKEN): cv.string,
+        probatio.Required(probatio.Secret(CONF_TOKEN)): cv.string,
         probatio.Optional(CONF_TIMEOUT, default=DEFAULT_TIMEOUT): cv.positive_int,
     }
 )
diff --git a/homeassistant/components/music_assistant/config_flow.py b/homeassistant/components/music_assistant/config_flow.py
index a98b16db7198..8c6cae7b6358 100644
--- a/homeassistant/components/music_assistant/config_flow.py
+++ b/homeassistant/components/music_assistant/config_flow.py
@@ -38,7 +38,9 @@ DEFAULT_URL = "http://mass.local:8095"
 
 
 STEP_USER_SCHEMA = probatio.Schema({probatio.Required(CONF_URL): str})
-STEP_AUTH_TOKEN_SCHEMA = probatio.Schema({probatio.Required(CONF_TOKEN): str})
+STEP_AUTH_TOKEN_SCHEMA = probatio.Schema(
+    {probatio.Required(probatio.Secret(CONF_TOKEN)): str}
+)
 
 
 def _parse_zeroconf_server_info(properties: dict[str, str]) -> ServerInfoMessage:
@@ -384,7 +386,9 @@ class MusicAssistantConfigFlow(ConfigFlow, domain=DOMAIN):
 
         return self.async_show_form(
             step_id="auth_manual",
-            data_schema=probatio.Schema({probatio.Required(CONF_TOKEN): str}),
+            data_schema=probatio.Schema(
+                {probatio.Required(probatio.Secret(CONF_TOKEN)): str}
+            ),
             description_placeholders={"url": self.url},
             errors=errors,
         )
diff --git a/homeassistant/components/notify_events/__init__.py b/homeassistant/components/notify_events/__init__.py
index 3503e80e68eb..3395eb0b095e 100644
--- a/homeassistant/components/notify_events/__init__.py
+++ b/homeassistant/components/notify_events/__init__.py
@@ -10,7 +10,11 @@ from homeassistant.helpers.typing import ConfigType
 from .const import DOMAIN
 
 CONFIG_SCHEMA = probatio.Schema(
-    {DOMAIN: probatio.Schema({probatio.Required(CONF_TOKEN): cv.string})},
+    {
+        DOMAIN: probatio.Schema(
+            {probatio.Required(probatio.Secret(CONF_TOKEN)): cv.string}
+        )
+    },
     extra=probatio.ALLOW_EXTRA,
 )
 
diff --git a/homeassistant/components/ntfy/config_flow.py b/homeassistant/components/ntfy/config_flow.py
index 5e0bed63b50f..28736488ed84 100644
--- a/homeassistant/components/ntfy/config_flow.py
+++ b/homeassistant/components/ntfy/config_flow.py
@@ -101,7 +101,7 @@ STEP_REAUTH_DATA_SCHEMA = probatio.Schema(
                 autocomplete="current-password",
             ),
         ),
-        probatio.Exclusive(CONF_TOKEN, ATTR_CREDENTIALS): str,
+        probatio.Exclusive(probatio.Secret(CONF_TOKEN), ATTR_CREDENTIALS): str,
     }
 )
 
@@ -119,7 +119,7 @@ STEP_RECONFIGURE_DATA_SCHEMA = probatio.Schema(
                 autocomplete="current-password",
             ),
         ),
-        probatio.Exclusive(CONF_TOKEN, ATTR_CREDENTIALS): str,
+        probatio.Exclusive(probatio.Secret(CONF_TOKEN), ATTR_CREDENTIALS): str,
     }
 )
 
diff --git a/homeassistant/components/nuki/config_flow.py b/homeassistant/components/nuki/config_flow.py
index c5971a819d57..6c66c6f29011 100644
--- a/homeassistant/components/nuki/config_flow.py
+++ b/homeassistant/components/nuki/config_flow.py
@@ -23,13 +23,13 @@ USER_SCHEMA = probatio.Schema(
     {
         probatio.Required(CONF_HOST): str,
         probatio.Optional(CONF_PORT, default=DEFAULT_PORT): probatio.Coerce(int),
-        probatio.Required(CONF_TOKEN): str,
+        probatio.Required(probatio.Secret(CONF_TOKEN)): str,
     }
 )
 
 REAUTH_SCHEMA = probatio.Schema(
     {
-        probatio.Required(CONF_TOKEN): str,
+        probatio.Required(probatio.Secret(CONF_TOKEN)): str,
         probatio.Optional(CONF_ENCRYPT_TOKEN, default=True): bool,
     }
 )
@@ -91,7 +91,7 @@ class NukiConfigFlow(ConfigFlow, domain=DOMAIN):
             {
                 probatio.Required(CONF_HOST, default=discovery_info.ip): str,
                 probatio.Required(CONF_PORT, default=DEFAULT_PORT): int,
-                probatio.Required(CONF_TOKEN): str,
+                probatio.Required(probatio.Secret(CONF_TOKEN)): str,
             }
         )
 
diff --git a/homeassistant/components/nyt_games/config_flow.py b/homeassistant/components/nyt_games/config_flow.py
index d3ff6c24ef5c..35c344225b83 100644
--- a/homeassistant/components/nyt_games/config_flow.py
+++ b/homeassistant/components/nyt_games/config_flow.py
@@ -42,6 +42,8 @@ class NYTGamesConfigFlow(ConfigFlow, domain=DOMAIN):
                 )
         return self.async_show_form(
             step_id="user",
-            data_schema=probatio.Schema({probatio.Required(CONF_TOKEN): str}),
+            data_schema=probatio.Schema(
+                {probatio.Required(probatio.Secret(CONF_TOKEN)): str}
+            ),
             errors=errors,
         )
diff --git a/homeassistant/components/otp/config_flow.py b/homeassistant/components/otp/config_flow.py
index 351f000efc14..37d895c6df2c 100644
--- a/homeassistant/components/otp/config_flow.py
+++ b/homeassistant/components/otp/config_flow.py
@@ -24,7 +24,7 @@ _LOGGER = logging.getLogger(__name__)
 
 STEP_USER_DATA_SCHEMA = probatio.Schema(
     {
-        probatio.Optional(CONF_TOKEN): str,
+        probatio.Optional(probatio.Secret(CONF_TOKEN)): str,
         probatio.Optional(CONF_NEW_TOKEN): BooleanSelector(BooleanSelectorConfig()),
         # Name field is no longer allowed in config flow schemas
         # pylint: disable-next=home-assistant-config-flow-name-field
diff --git a/homeassistant/components/overkiz/config_flow.py b/homeassistant/components/overkiz/config_flow.py
index 617bd6e6522e..ead291b1db58 100644
--- a/homeassistant/components/overkiz/config_flow.py
+++ b/homeassistant/components/overkiz/config_flow.py
@@ -350,7 +350,7 @@ class OverkizConfigFlow(
             data_schema=probatio.Schema(
                 {
                     probatio.Required(CONF_HOST, default=self._host): str,
-                    probatio.Required(CONF_TOKEN): str,
+                    probatio.Required(probatio.Secret(CONF_TOKEN)): str,
                     probatio.Required(CONF_VERIFY_SSL, default=self._verify_ssl): bool,
                 }
             ),
diff --git a/homeassistant/components/plaato/config_flow.py b/homeassistant/components/plaato/config_flow.py
index 41e142d07278..7c6820388d72 100644
--- a/homeassistant/components/plaato/config_flow.py
+++ b/homeassistant/components/plaato/config_flow.py
@@ -148,7 +148,9 @@ class PlaatoConfigFlow(ConfigFlow, domain=DOMAIN):
     async def _show_api_method_form(
         self, device_type: PlaatoDeviceType, errors: dict[str, str] | None = None
     ) -> ConfigFlowResult:
-        data_schema = probatio.Schema({probatio.Optional(CONF_TOKEN, default=""): str})
+        data_schema = probatio.Schema(
+            {probatio.Optional(probatio.Secret(CONF_TOKEN), default=""): str}
+        )
 
         if device_type == PlaatoDeviceType.Airlock:
             data_schema = data_schema.extend(
diff --git a/homeassistant/components/ruuvi_gateway/schemata.py b/homeassistant/components/ruuvi_gateway/schemata.py
index 0272da2b8931..b8e3d74d1d1a 100644
--- a/homeassistant/components/ruuvi_gateway/schemata.py
+++ b/homeassistant/components/ruuvi_gateway/schemata.py
@@ -7,7 +7,7 @@ from homeassistant.const import CONF_HOST, CONF_TOKEN
 CONFIG_SCHEMA = probatio.Schema(
     {
         probatio.Required(CONF_HOST): str,
-        probatio.Required(CONF_TOKEN): str,
+        probatio.Required(probatio.Secret(CONF_TOKEN)): str,
     }
 )
 
diff --git a/homeassistant/components/sanix/config_flow.py b/homeassistant/components/sanix/config_flow.py
index 024e772be9bf..24f7bbf5fde8 100644
--- a/homeassistant/components/sanix/config_flow.py
+++ b/homeassistant/components/sanix/config_flow.py
@@ -18,7 +18,7 @@ _LOGGER = logging.getLogger(__name__)
 STEP_USER_DATA_SCHEMA = probatio.Schema(
     {
         probatio.Required(CONF_SERIAL_NUMBER): str,
-        probatio.Required(CONF_TOKEN): str,
+        probatio.Required(probatio.Secret(CONF_TOKEN)): str,
     }
 )
 
diff --git a/homeassistant/components/splunk/config_flow.py b/homeassistant/components/splunk/config_flow.py
index d05d83f891f5..43700b6676d6 100644
--- a/homeassistant/components/splunk/config_flow.py
+++ b/homeassistant/components/splunk/config_flow.py
@@ -53,7 +53,7 @@ class SplunkConfigFlow(ConfigFlow, domain=DOMAIN):
             step_id="user",
             data_schema=probatio.Schema(
                 {
-                    probatio.Required(CONF_TOKEN): str,
+                    probatio.Required(probatio.Secret(CONF_TOKEN)): str,
                     probatio.Required(CONF_HOST): str,
                     probatio.Optional(CONF_PORT, default=DEFAULT_PORT): int,
                     probatio.Optional(CONF_SSL, default=DEFAULT_SSL): bool,
@@ -85,7 +85,7 @@ class SplunkConfigFlow(ConfigFlow, domain=DOMAIN):
             data_schema=self.add_suggested_values_to_schema(
                 probatio.Schema(
                     {
-                        probatio.Required(CONF_TOKEN): str,
+                        probatio.Required(probatio.Secret(CONF_TOKEN)): str,
                         probatio.Required(CONF_HOST): str,
                         probatio.Optional(CONF_PORT, default=DEFAULT_PORT): int,
                         probatio.Optional(CONF_SSL, default=DEFAULT_SSL): bool,
@@ -125,7 +125,9 @@ class SplunkConfigFlow(ConfigFlow, domain=DOMAIN):
 
         return self.async_show_form(
             step_id="reauth_confirm",
-            data_schema=probatio.Schema({probatio.Required(CONF_TOKEN): str}),
+            data_schema=probatio.Schema(
+                {probatio.Required(probatio.Secret(CONF_TOKEN)): str}
+            ),
             errors=errors,
         )
 
diff --git a/homeassistant/components/switcher_kis/config_flow.py b/homeassistant/components/switcher_kis/config_flow.py
index c9459822b6d6..ac60dc3b16d2 100644
--- a/homeassistant/components/switcher_kis/config_flow.py
+++ b/homeassistant/components/switcher_kis/config_flow.py
@@ -20,7 +20,7 @@ _LOGGER = logging.getLogger(__name__)
 CONFIG_SCHEMA: Final = probatio.Schema(
     {
         probatio.Required(CONF_USERNAME): str,
-        probatio.Required(CONF_TOKEN): str,
+        probatio.Required(probatio.Secret(CONF_TOKEN)): str,
     }
 )
 
diff --git a/homeassistant/components/syncthing/config_flow.py b/homeassistant/components/syncthing/config_flow.py
index 899e3ad51194..3dd095e45f92 100644
--- a/homeassistant/components/syncthing/config_flow.py
+++ b/homeassistant/components/syncthing/config_flow.py
@@ -15,7 +15,7 @@ from .const import DEFAULT_URL, DEFAULT_VERIFY_SSL, DOMAIN
 DATA_SCHEMA = probatio.Schema(
     {
         probatio.Required(CONF_URL, default=DEFAULT_URL): str,
-        probatio.Required(CONF_TOKEN): str,
+        probatio.Required(probatio.Secret(CONF_TOKEN)): str,
         probatio.Required(CONF_VERIFY_SSL, default=DEFAULT_VERIFY_SSL): bool,
     }
 )
diff --git a/homeassistant/components/system_bridge/config_flow.py b/homeassistant/components/system_bridge/config_flow.py
index d088f78d442b..1399e23eedcd 100644
--- a/homeassistant/components/system_bridge/config_flow.py
+++ b/homeassistant/components/system_bridge/config_flow.py
@@ -27,13 +27,13 @@ from .const import DATA_WAIT_TIMEOUT, DOMAIN
 _LOGGER = logging.getLogger(__name__)
 
 STEP_AUTHENTICATE_DATA_SCHEMA = probatio.Schema(
-    {probatio.Required(CONF_TOKEN): cv.string}
+    {probatio.Required(probatio.Secret(CONF_TOKEN)): cv.string}
 )
 STEP_USER_DATA_SCHEMA = probatio.Schema(
     {
         probatio.Required(CONF_HOST): cv.string,
         probatio.Required(CONF_PORT, default=9170): cv.string,
-        probatio.Required(CONF_TOKEN): cv.string,
+        probatio.Required(probatio.Secret(CONF_TOKEN)): cv.string,
     }
 )
 
diff --git a/homeassistant/components/tailwind/config_flow.py b/homeassistant/components/tailwind/config_flow.py
index d4f65c615716..70631e90a038 100644
--- a/homeassistant/components/tailwind/config_flow.py
+++ b/homeassistant/components/tailwind/config_flow.py
@@ -77,7 +77,7 @@ class TailwindFlowHandler(ConfigFlow, domain=DOMAIN):
                     probatio.Required(
                         CONF_HOST, default=user_input.get(CONF_HOST)
                     ): TextSelector(TextSelectorConfig(autocomplete="off")),
-                    probatio.Required(CONF_TOKEN): TextSelector(
+                    probatio.Required(probatio.Secret(CONF_TOKEN)): TextSelector(
                         TextSelectorConfig(type=TextSelectorType.PASSWORD)
                     ),
                 }
@@ -139,7 +139,7 @@ class TailwindFlowHandler(ConfigFlow, domain=DOMAIN):
             step_id="zeroconf_confirm",
             data_schema=probatio.Schema(
                 {
-                    probatio.Required(CONF_TOKEN): TextSelector(
+                    probatio.Required(probatio.Secret(CONF_TOKEN)): TextSelector(
                         TextSelectorConfig(type=TextSelectorType.PASSWORD)
                     ),
                 }
@@ -179,7 +179,7 @@ class TailwindFlowHandler(ConfigFlow, domain=DOMAIN):
                         CONF_HOST,
                         default=reconfigure_entry.data[CONF_HOST],
                     ): TextSelector(TextSelectorConfig(autocomplete="off")),
-                    probatio.Required(CONF_TOKEN): TextSelector(
+                    probatio.Required(probatio.Secret(CONF_TOKEN)): TextSelector(
                         TextSelectorConfig(type=TextSelectorType.PASSWORD)
                     ),
                 }
@@ -218,7 +218,7 @@ class TailwindFlowHandler(ConfigFlow, domain=DOMAIN):
             step_id="reauth_confirm",
             data_schema=probatio.Schema(
                 {
-                    probatio.Required(CONF_TOKEN): TextSelector(
+                    probatio.Required(probatio.Secret(CONF_TOKEN)): TextSelector(
                         TextSelectorConfig(type=TextSelectorType.PASSWORD)
                     ),
                 }
diff --git a/homeassistant/components/todoist/calendar.py b/homeassistant/components/todoist/calendar.py
index 59cbffcd10a8..76cef5f5e33f 100644
--- a/homeassistant/components/todoist/calendar.py
+++ b/homeassistant/components/todoist/calendar.py
@@ -52,7 +52,7 @@ _LOGGER = logging.getLogger(__name__)
 
 PLATFORM_SCHEMA = CALENDAR_PLATFORM_SCHEMA.extend(
     {
-        probatio.Required(CONF_TOKEN): cv.string,
+        probatio.Required(probatio.Secret(CONF_TOKEN)): cv.string,
         probatio.Optional(CONF_EXTRA_PROJECTS, default=[]): probatio.All(
             probatio.EnsureList(),
             probatio.Schema(
diff --git a/homeassistant/components/todoist/config_flow.py b/homeassistant/components/todoist/config_flow.py
index 190a33181e38..e6946da3d081 100644
--- a/homeassistant/components/todoist/config_flow.py
+++ b/homeassistant/components/todoist/config_flow.py
@@ -20,7 +20,7 @@ SETTINGS_URL = "https://app.todoist.com/app/settings/integrations/developer"
 
 STEP_USER_DATA_SCHEMA = probatio.Schema(
     {
-        probatio.Required(CONF_TOKEN): str,
+        probatio.Required(probatio.Secret(CONF_TOKEN)): str,
     }
 )
 
diff --git a/homeassistant/components/wattwaechter/config_flow.py b/homeassistant/components/wattwaechter/config_flow.py
index b5c81776f59e..860a9c2385b0 100644
--- a/homeassistant/components/wattwaechter/config_flow.py
+++ b/homeassistant/components/wattwaechter/config_flow.py
@@ -211,7 +211,7 @@ class WattwaechterConfigFlow(ConfigFlow, domain=DOMAIN):
             step_id="auth",
             data_schema=probatio.Schema(
                 {
-                    probatio.Required(CONF_TOKEN): str,
+                    probatio.Required(probatio.Secret(CONF_TOKEN)): str,
                 }
             ),
             errors=errors,
@@ -246,7 +246,7 @@ class WattwaechterConfigFlow(ConfigFlow, domain=DOMAIN):
             step_id="reauth_confirm",
             data_schema=probatio.Schema(
                 {
-                    probatio.Required(CONF_TOKEN): str,
+                    probatio.Required(probatio.Secret(CONF_TOKEN)): str,
                 }
             ),
             description_placeholders={"host": reauth_entry.data[CONF_HOST]},
@@ -279,7 +279,7 @@ class WattwaechterConfigFlow(ConfigFlow, domain=DOMAIN):
         schema = probatio.Schema(
             {
                 probatio.Required(CONF_HOST): str,
-                probatio.Optional(CONF_TOKEN): TextSelector(
+                probatio.Optional(probatio.Secret(CONF_TOKEN)): TextSelector(
                     TextSelectorConfig(type=TextSelectorType.PASSWORD)
                 ),
             }
diff --git a/homeassistant/components/xiaomi_miio/config_flow.py b/homeassistant/components/xiaomi_miio/config_flow.py
index f44d830c1251..dd070339563d 100644
--- a/homeassistant/components/xiaomi_miio/config_flow.py
+++ b/homeassistant/components/xiaomi_miio/config_flow.py
@@ -42,7 +42,9 @@ from .typing import XiaomiMiioConfigEntry
 _LOGGER = logging.getLogger(__name__)
 
 DEVICE_SETTINGS = {
-    probatio.Required(CONF_TOKEN): probatio.All(str, probatio.Length(min=32, max=32)),
+    probatio.Required(probatio.Secret(CONF_TOKEN)): probatio.All(
+        str, probatio.Length(min=32, max=32)
+    ),
 }
 DEVICE_CONFIG = probatio.Schema({probatio.Required(CONF_HOST): str}).extend(
     DEVICE_SETTINGS
diff --git a/homeassistant/components/xiaomi_miio/device_tracker.py b/homeassistant/components/xiaomi_miio/device_tracker.py
index 0cf1fa711c11..c74977169e79 100644
--- a/homeassistant/components/xiaomi_miio/device_tracker.py
+++ b/homeassistant/components/xiaomi_miio/device_tracker.py
@@ -21,7 +21,7 @@ _LOGGER = logging.getLogger(__name__)
 PLATFORM_SCHEMA = DEVICE_TRACKER_PLATFORM_SCHEMA.extend(
     {
         probatio.Required(CONF_HOST): cv.string,
-        probatio.Required(CONF_TOKEN): probatio.All(
+        probatio.Required(probatio.Secret(CONF_TOKEN)): probatio.All(
             cv.string, probatio.Length(min=32, max=32)
         ),
     }
diff --git a/homeassistant/components/xiaomi_miio/remote.py b/homeassistant/components/xiaomi_miio/remote.py
index 1df7acfe6249..166211da9ab7 100644
--- a/homeassistant/components/xiaomi_miio/remote.py
+++ b/homeassistant/components/xiaomi_miio/remote.py
@@ -55,7 +55,7 @@ PLATFORM_SCHEMA = REMOTE_PLATFORM_SCHEMA.extend(
         probatio.Optional(CONF_SLOT, default=DEFAULT_SLOT): probatio.All(
             int, probatio.Range(min=1, max=1000000)
         ),
-        probatio.Required(CONF_TOKEN): probatio.All(
+        probatio.Required(probatio.Secret(CONF_TOKEN)): probatio.All(
             str, probatio.Length(min=32, max=32)
         ),
         probatio.Optional(CONF_COMMANDS, default={}): cv.schema_with_slug_keys(
diff --git a/homeassistant/components/zwave_me/config_flow.py b/homeassistant/components/zwave_me/config_flow.py
index 1598606d57a0..330e79eaa3b4 100644
--- a/homeassistant/components/zwave_me/config_flow.py
+++ b/homeassistant/components/zwave_me/config_flow.py
@@ -46,13 +46,13 @@ class ZWaveMeConfigFlow(ConfigFlow, domain=DOMAIN):
             schema = probatio.Schema(
                 {
                     probatio.Required(CONF_URL): str,
-                    probatio.Required(CONF_TOKEN): str,
+                    probatio.Required(probatio.Secret(CONF_TOKEN)): str,
                 }
             )
         else:
             schema = probatio.Schema(
                 {
-                    probatio.Required(CONF_TOKEN): str,
+                    probatio.Required(probatio.Secret(CONF_TOKEN)): str,
                 }
             )