Permission: `tokens`. The secret is returned only on create.