diff --git a/docs/plugins.rst b/docs/plugins.rst
index d2b5c20a..d32a9fe6 100644
--- a/docs/plugins.rst
+++ b/docs/plugins.rst
@@ -459,6 +459,8 @@ Secret configuration values
 
 Some plugins may need configuration that should stay secret - API keys for example. There are two ways in which you can store secret configuration values.
 
+The :ref:`/-/config <JsonDataView_config>` introspection endpoint redacts the values of any configuration keys whose names contain one of these substrings: ``secret``, ``key``, ``password``, ``token``, ``hash`` or ``dsn``. Name your plugin's secret configuration keys accordingly - for example ``api_key`` or ``client_secret`` - so they are automatically redacted there.
+
 **As environment variables**. If your secret lives in an environment variable that is available to the Datasette process, you can indicate that the configuration value should be read from that environment variable like so:
 
 .. [[[cog