I think this needs more protection not less - dashboard could have 2FA on login - and perhaps each network should have a shown once resettable 'master key' - and you need to enter that key to modify a network - once you enter that key - yes show the tokens and be able to do whatever on that network. As things stand it doesn't really matter if you show the token or not as anyone with access to the dashboard can go ahead and make new keys and mess around anyway. Whatever the decision some consideration should be made towards a longer-term RBAC system whereby people with particular roles have particular rights to view / modify a network and its nodes. Potentially in the future end-users are able to login to dashboard and see tokens only on specific networks they are allowed to access - or view the access tokens they are assigned to see - so that they can self-service adding new nodes / new external clients. Additionally tokens could auto-expire after a period of time for joining of nodes - in which case show the token - but it is useless after a while. Or tokens are only valid if when you join you enter a valid 2FA or network password in which case it doesnt matter if the token leaks. e.g. are you clearing out shell history on nodes after joining ? The API idea is also gold - this would allow a mechanism to script the addition of nodes on cloud-init etc.