Debuting in dotCMS 23.07, the Secrets Viewtool allows passing of a secret string or character array — such as a token, key, password, etc. — via Velocity, without including sensitive data in the VTL file. For more info & best practices, please see the documentation page.