diff --git a/manifests/api.pp b/manifests/api.pp
index 083fb586d..9b09748d6 100644
--- a/manifests/api.pp
+++ b/manifests/api.pp
@@ -492,7 +492,7 @@ as a standalone service, or httpd for being run by a httpd server")
     nova_config {
       'neutron/service_metadata_proxy': value => true;
       'neutron/metadata_proxy_shared_secret':
-        value => $neutron_metadata_proxy_shared_secret;
+        value => $neutron_metadata_proxy_shared_secret, secret => true;
     }
   } else {
     nova_config {
diff --git a/spec/classes/nova_api_spec.rb b/spec/classes/nova_api_spec.rb
index 11c624388..f5ce61dd1 100644
--- a/spec/classes/nova_api_spec.rb
+++ b/spec/classes/nova_api_spec.rb
@@ -168,7 +168,7 @@ describe 'nova::api' do
         is_expected.to contain_nova_config('api/compute_link_prefix').with('value' => 'https://10.0.0.1:7777/')
         is_expected.to contain_nova_config('api/glance_link_prefix').with('value' => 'https://10.0.0.1:6666/')
         is_expected.to contain_nova_config('neutron/service_metadata_proxy').with('value' => true)
-        is_expected.to contain_nova_config('neutron/metadata_proxy_shared_secret').with('value' => 'secrete')
+        is_expected.to contain_nova_config('neutron/metadata_proxy_shared_secret').with('value' => 'secrete').with_secret(true)
         is_expected.to contain_nova_config('oslo_middleware/enable_proxy_headers_parsing').with('value' => true)
         is_expected.to contain_nova_config('api/hide_server_address_states').with('value' => 'building')
         is_expected.to contain_nova_config('api/allow_instance_snapshots').with('value' => true)