Show the first and last characters of a newly created Personal Access Token#4363
Merged
Conversation
The token shown after creating a Personal Access Token was fully masked, so users had no way to confirm they had copied the right value. The field now reveals the first and last few characters in cleartext (the middle stays masked), matching the partial display already used in the tokens list. Adds general `secureRevealStart` / `secureRevealEnd` props to ClipboardField (default 0/0, so all other usages remain fully masked) and enables 4/4 in the token creation dialog. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ws8U3Nx9CBQKWPPg1u2Yy4
|
carderne
marked this pull request as ready for review
July 24, 2026 11:46
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
carderne
approved these changes
Jul 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Dan Sutton · Slack thread
✅ Checklist
Testing
pnpm run typecheck --filter webapp— 18/18 pass.tr_pat_bhbd•••••fd4astyle partial display (first and last characters visible, middle masked), and that the copy button still copies the full token.Changelog
What & why
Before: after creating a Personal Access Token, the generated token was shown fully masked (shield icon + dots), so there was no way to confirm you'd copied the right value.
After: the field reveals the first and last few characters in cleartext while keeping the middle masked, matching the partial display already used in the tokens list table (
tr_pat_bhbd•••••fd4a), so you can confirm the copied value at a glance. The copy button still copies the full token.How
secureRevealStart/secureRevealEndprops toClipboardField(both default0, so every other usage stays fully masked and unchanged). AmaskValue()helper builds the display string as revealed-start + mask + revealed-end, and never leaks the whole value.account.tokensroute) setssecureRevealStart={11}(7-chartr_pat_prefix + 4 token chars) andsecureRevealEnd={4}to mirror the tokens-list display exactly..server-changesnote (webapp-only change; no changeset since the webapp isn't a published package).Screenshots
No screenshots — verifying visually requires running the full webapp dev stack, which was out of scope for this change.
💯