For now the method ConsumerAcceptance::userCanSeeSecret() just returns a message object and does not have any logic inside.
So permission check should be added.
The task is related to T264457: Client secret shared between clients and depends on the final solution of that task.
As API Gateway is nowadays owned by ServiceOps, adding the ServiceOps project tag to open API Gateway tasks tagged with the deprecated/archived "Platform Team Initiatives (API Gateway)" tag at https://phabricator.wikimedia.org/project/profile/4321/, as part of Phabricator Housekeeping.
@roman-stolar: Removing task assignee as this open task has been assigned for more than two years - See the email sent to task assignee on October 11th.
Please assign this task to yourself again if you still realistically [plan to] work on this task - it would be welcome! :)
If this task has been resolved in the meantime, or should not be worked on by anybody ("declined"), please update its task status via "Add Action… 🡒 Change Status".
Also see https://www.mediawiki.org/wiki/Bug_management/Assignee_cleanup for tips how to best manage your individual work in Phabricator. Thanks!
Right now userCanSeeSecret denies anyone from seeing the secret (except once during creation). According to @Tgr this is similar to other platforms, which don't let you see it later either. There's not a strong reason to disallow access to it, so this is a production question, about use case and potential risk trade-off. Punting to @JTweed-WMF to decide next week.