Skip to main content
Drupal is a registered trademark of Dries Buytaert
Release: OpenID Connect / OAuth client 3.0.0-alpha9 — New alpha version released for module openid_connect (3.0.0-alpha9). Usage Milestone: Google Analytics — Module google_analytics crossed 1,000 active installs. Release: Timelinr 1.0.1 — Minor update available for module timelinr (1.0.1). Release: GraphQL Compose Codegen 1.1.2 — Minor update available for module graphql_compose_codegen (1.1.2). Release: Mapy.com 1.1.3 — Minor update available for module mapycom (1.1.3). Release: Ckeditor5 entity browser 3.0.3 — Minor update available for module ckeditor5_entity_browser (3.0.3). Release: Ckeditor5 entity browser 3.0.1 — Minor update available for module ckeditor5_entity_browser (3.0.1). Release: Ckeditor5 entity browser 3.0.2 — Minor update available for module ckeditor5_entity_browser (3.0.2). Release: Teamleader Integration 4.0.2 — Minor update available for module teamleader (4.0.2). Module Revived: Entityqueue Buttons 1.1.2 — Module entityqueue_buttons updated after 8 months of inactivity (1.1.2).

Credential mask

24 sites Security covered Drupal 8–11
View on drupal.org

This module prevents sensitive configuration values like API keys from being accidentally committed to your source code. It integrates with Drupal's configuration system to mask these values during export and protect them during import.

Security lead

Whatever you do, don't let this API key get committed!

Developer

  drush config:export

Developer

Uh-oh…

Description

Best practice is to export your configuration and commit it to your source-code repository.
Best practice is also to avoid committing API keys, secrets, etc.

The credential mask module integrates with the configuration management API and ensures that the configuration keys marked as "sensitive" are not exported, and when configuration is imported, the unmasked configuration is not overridden.

Operation

Sensitive items can be managed either:

  1. via Drush
  2. via /admin/config/development/configuration/credential_mask (for users with the "import configuration" permission

Drush Commands

  • credential_mask:add
    Mark a config key as sensitive.
  • credential_mask:del
    Remove a config key from the list of masked credentials.
  • credential_mask:list
    List all active configuration properties identified as sensitive.
  • credential_mask:show-configuration
    Show the configuration names and properties currently marked as sensitive.

Version requirements

  • Drupal core 8.8 or greater
  • Drush 10 or greater.

Similar modules

Other modules in the configuration-management ecosystem, such as Config split and Config filter may provide similar behaviour, or tools to achieve a similar outcome.

Depends on

Dependencies of the latest stable release

No dependencies recorded for this project.

Required by

Tracked projects that depend on this one

No tracked projects depend on this one yet.

Activity

Tracked releases
4
Tracked since
Oct 2025
Latest release
6 months ago
Releases (12 mo)
4 ▲ from 0
Maintenance
Slowing

Release Timeline

Releases

Version Type Core Release date
1.0.0 Stable 8–11 Feb 17, 2026
1.0.0-alpha3 Pre-release 8–10 Jan 6, 2026
1.0.0-alpha2 Pre-release 8–10 Dec 1, 2025
1.0.0-alpha1 Pre-release 8–10 Oct 9, 2025