diff --git a/api/config.go b/api/config.go
index 354ea2a..7b037d8 100644
--- a/api/config.go
+++ b/api/config.go
@@ -65,6 +65,7 @@ func registerConfig() error {
 		Name:           "API Keys",
 		Key:            CfgAPIKeys,
 		Description:    "Define API keys for priviledged access to the API. Every entry is a separate API key with respective permissions. Format is `<key>?read=<perm>&write=<perm>`. Permissions are `anyone`, `user` and `admin`, and may be omitted.",
+		Sensitive:      true,
 		OptType:        config.OptTypeStringArray,
 		ExpertiseLevel: config.ExpertiseLevelDeveloper,
 		ReleaseLevel:   config.ReleaseLevelStable,
diff --git a/config/option.go b/config/option.go
index 9cbfde1..84166f1 100644
--- a/config/option.go
+++ b/config/option.go
@@ -190,6 +190,9 @@ type Option struct {
 	// Help is considered immutable after the option has
 	// been created.
 	Help string
+	// Sensitive signifies that the configuration values may contain sensitive
+	// content, such as authentication keys.
+	Sensitive bool
 	// OptType defines the type of the option.
 	// OptType is considered immutable after the option has
 	// been created.
diff --git a/metrics/config.go b/metrics/config.go
index 2b011e6..5815b84 100644
--- a/metrics/config.go
+++ b/metrics/config.go
@@ -41,6 +41,7 @@ func prepConfig() error {
 		Name:            "Metrics Instance Name",
 		Key:             CfgOptionInstanceKey,
 		Description:     "Define the prometheus instance label for exported metrics. Please note that changing the instance name will reset persisted metrics.",
+		Sensitive:       true,
 		OptType:         config.OptTypeString,
 		ExpertiseLevel:  config.ExpertiseLevelExpert,
 		ReleaseLevel:    config.ReleaseLevelStable,
@@ -61,6 +62,7 @@ func prepConfig() error {
 		Name:            "Push Prometheus Metrics",
 		Key:             CfgOptionPushKey,
 		Description:     "Push metrics to this URL in the prometheus format.",
+		Sensitive:       true,
 		OptType:         config.OptTypeString,
 		ExpertiseLevel:  config.ExpertiseLevelExpert,
 		ReleaseLevel:    config.ReleaseLevelStable,