Hide API token by default, make visible with a click