diff --git a/manifests/plugins/nsx.pp b/manifests/plugins/nsx.pp
index 593e545b5..a593d84c4 100644
--- a/manifests/plugins/nsx.pp
+++ b/manifests/plugins/nsx.pp
@@ -151,7 +151,7 @@ class neutron::plugins::nsx (
     'nsx_v3/default_tier0_router':     value => $default_tier0_router;
     'nsx_v3/nsx_api_managers':         value => $nsx_api_managers;
     'nsx_v3/nsx_api_user':             value => $nsx_api_user;
-    'nsx_v3/nsx_api_password':         value => $nsx_api_password;
+    'nsx_v3/nsx_api_password':         value => $nsx_api_password, secret => true;
     'nsx_v3/dhcp_profile':             value => pick($dhcp_profile_uuid, $dhcp_profile);
     'nsx_v3/dhcp_relay_service':       value => $dhcp_relay_service;
     'nsx_v3/metadata_proxy':           value => pick($metadata_proxy_uuid, $metadata_proxy);
diff --git a/spec/classes/neutron_plugins_nsx_spec.rb b/spec/classes/neutron_plugins_nsx_spec.rb
index 747c1e66b..2eb8cf8bb 100644
--- a/spec/classes/neutron_plugins_nsx_spec.rb
+++ b/spec/classes/neutron_plugins_nsx_spec.rb
@@ -66,7 +66,7 @@ describe 'neutron::plugins::nsx' do
         should contain_neutron_plugin_nsx('nsx_v3/default_bridge_cluster').with_value(default_params[:default_bridge_cluster])
         should contain_neutron_plugin_nsx('nsx_v3/default_tier0_router').with_value(default_params[:default_tier0_router])
         should contain_neutron_plugin_nsx('nsx_v3/nsx_api_managers').with_value(default_params[:nsx_api_managers])
-        should contain_neutron_plugin_nsx('nsx_v3/nsx_api_password').with_value(default_params[:nsx_api_password])
+        should contain_neutron_plugin_nsx('nsx_v3/nsx_api_password').with_value(default_params[:nsx_api_password]).with_secret(true)
         should contain_neutron_plugin_nsx('nsx_v3/dhcp_profile').with_value(default_params[:dhcp_profile])
         should contain_neutron_plugin_nsx('nsx_v3/dhcp_relay_service').with_value(default_params[:dhcp_relay_service])
         should contain_neutron_plugin_nsx('nsx_v3/metadata_proxy').with_value(default_params[:metadata_proxy])
@@ -98,7 +98,7 @@ describe 'neutron::plugins::nsx' do
         should contain_neutron_plugin_nsx('nsx_v3/default_bridge_cluster').with_value(params[:default_bridge_cluster])
         should contain_neutron_plugin_nsx('nsx_v3/default_tier0_router').with_value(params[:default_tier0_router])
         should contain_neutron_plugin_nsx('nsx_v3/nsx_api_managers').with_value(params[:nsx_api_managers])
-        should contain_neutron_plugin_nsx('nsx_v3/nsx_api_password').with_value(params[:nsx_api_password])
+        should contain_neutron_plugin_nsx('nsx_v3/nsx_api_password').with_value(params[:nsx_api_password]).with_secret(true)
         should contain_neutron_plugin_nsx('nsx_v3/dhcp_profile').with_value(params[:dhcp_profile])
         should contain_neutron_plugin_nsx('nsx_v3/dhcp_relay_service').with_value(params[:dhcp_relay_service])
         should contain_neutron_plugin_nsx('nsx_v3/metadata_proxy').with_value(params[:metadata_proxy])