I think it's totally okay to have an api key as a (non obfuscated) text input. This is part of the configuration, one should be able to know which api key is configured at any time. Plus, it's weird to display a password input with a value as you only see dots but can't know what's inside.