diff --git a/plugins/printedparts/plugin.py b/plugins/printedparts/plugin.py
index 7fc89f41..9d788bb0 100644
--- a/plugins/printedparts/plugin.py
+++ b/plugins/printedparts/plugin.py
@@ -162,7 +162,11 @@ class PrintedpartsPlugin(BasePlugin):
             {
                 'key': 'printedparts_kiosk_token',
                 'value': '',
-                'valuetype': 'secret',
+                # string, not 'secret': the column documents string/boolean/
+                # integer/json only. Masking is keyed on the NAME containing
+                # 'token' (settings.py::_is_secret), so this is still hidden in
+                # the API and the audit log.
+                'valuetype': 'string',
                 'category': 'printedparts',
                 'description': 'Device token the kiosk sends as X-Kiosk-Token. '
                                'Generate one, then open the kiosk once as '