anytech / silverstripe-secretfield

dev-main 2026-11-12 01:31 UTC

Requires

• php: ^8.3
• ext-json: *
• silverstripe/framework: ^6.1
• silverstripe/siteconfig: ^6
• silverstripe/vendor-plugin: ^3

MIT

• Kayne Middleton

• silverstripe
• mask
• secret
• api-key
• form-field

Published on Packagist.org on 2026-11-12 01:31 UTC

README

A masked form field for secrets on any record (API keys, tokens, passwords, service-account JSON), SiteConfig or any other DataObject. The stored value is never rendered into the page source; an admin-only reveal button fetches it on demand.

Requirements

• SilverStripe ^6.1
• PHP ^8.3

Installation

composer require anytech/silverstripe-secretfield

Usage

Use SecretField in place of TextField in a record's getCMSFields(). No config to declare.

use Anytech\SecretField\SecretField;

SecretField::create('ApiKey', 'API key');
SecretField::create('ServiceAccountJSON', 'Service account JSON')->setMultiline(true);
SecretField::create('Password', 'Portal password')->setShowTail(false);

• When a value is saved the field shows a hint, "Saved (ends abcd) - leave blank to keep". setShowTail(false) drops the last four characters from the hint, for passwords and anything else where part of the value must not show.
• Leaving the field blank on save keeps the stored value.
• Reveal is restricted to ADMIN and CSRF-protected via the CMS security token.
• Reveal needs a saved record: the button appears only when the form was loaded from a record that exists in the database (Form::loadDataFrom()), which every CMS edit form, SiteConfig included, does.
• A field is revealable only if that record's own getCMSFields() declares it as a SecretField, and the admin can view the record.
• Works on disabled fields too (e.g. autofilled tokens) - reveal only reads.

License

MIT