@@ -67,6 +67,14 @@ async def post(self):
         return self.postdata
 
 
+class FakeGetRequest:
+    """A minimal aiohttp-request stand-in exposing only the query string the handler reads."""
+
+    def __init__(self, query):
+        """Store the query parameters this request will hand back."""
+        self.query = query
+
+
 def _load_yaml(path="apps.yaml"):
     """Load a YAML file from the temporary working directory."""
     yaml = YAML()
@@ -502,6 +510,53 @@ def run_web_apps_edit_tests(my_predbat):
             print("  ERROR: the rotated credential was not written")
             failed += 1
 
+        # ---------------------------------------------------------------------
+        # The page serving the mask meant clicking Edit on a credential filled the input with
+        # "xxx": the real key could not be seen or amended, only retyped from scratch. The page
+        # stays masked; Edit fetches the one real value through /apps_value instead.
+        print("Test: credential rows are flagged for reveal-on-edit and still served masked")
+        text = _render_apps_page(my_predbat, {"octopus_api_key": "sk-top-level-credential-0000", "chat": {"providers": {"openrouter": {"api_key": "sk-live-nested-credential-1234", "model": "some-model"}}}})
+        if "sk-top-level-credential-0000" in text or "sk-live-nested-credential-1234" in text:
+            print("  ERROR: a credential reached the rendered page in the clear")
+            failed += 1
+        if not re.search(r'<tr id="row_\d+" data-arg-name="octopus_api_key" data-original-value="xxx" data-secret="1">', text):
+            print("  ERROR: the top-level credential row should be masked and flagged data-secret")
+            failed += 1
+        if not re.search(r"data-nested-path='chat\.providers\.openrouter\.api_key' data-nested-original='xxx' data-secret='1'", text):
+            print("  ERROR: the nested credential row should be masked and flagged data-secret")
+            failed += 1
+        if re.search(r"data-nested-path='chat\.providers\.openrouter\.model'[^>]*data-secret", text):
+            print("  ERROR: a non-credential sibling must not be flagged data-secret")
+            failed += 1
+
+        print("Test: /apps_value hands back the real value of the credential being edited")
+        web_interface = _reset_fixture(my_predbat)
+        for path, expected in (("chat.providers.openrouter.api_key", "sk-live-nested-credential-1234"), ("forecast_solar[0].api_key", "fs-live-credential-5678"), ("forecast_solar[0].declination", "30")):
+            result = json.loads(asyncio.run(web_interface.html_apps_value(FakeGetRequest({"path": path}))).text)
+            if not result.get("success") or result.get("value") != expected:
+                print("  ERROR: expected /apps_value for {} to return {}, got: {}".format(path, expected, result))
+                failed += 1
+
+        print("Test: /apps_value refuses a missing path or a whole structure")
+        for query in ({}, {"path": "chat.providers.nope"}, {"path": "chat.providers"}):
+            result = json.loads(asyncio.run(web_interface.html_apps_value(FakeGetRequest(query))).text)
+            if result.get("success") or "value" in result:
+                print("  ERROR: expected /apps_value to refuse {}, got: {}".format(query, result))
+                failed += 1
+
+        print("Test: Edit reveals a flagged credential before opening the input")
+        for function, attribute in (("editValue", "originalValue"), ("editNestedValue", "nestedOriginal")):
+            edit_src = apps_js[apps_js.index("function {}(".format(function)) :]
+            edit_src = edit_src[: edit_src.index("\n}\n")]
+            if "row.dataset.secret === '1'" not in edit_src or "revealSecretValue(row, '{}'".format(attribute) not in edit_src:
+                print("  ERROR: expected {} to fetch the real value of a data-secret row, got:\n{}".format(function, edit_src))
+                failed += 1
+        reveal_src = apps_js[apps_js.index("async function revealSecretValue(") :]
+        reveal_src = reveal_src[: reveal_src.index("\n}\n")]
+        if "fetch('./apps_value?path=' + encodeURIComponent(path))" not in reveal_src or "delete row.dataset.secret" not in reveal_src:
+            print("  ERROR: expected revealSecretValue to fetch /apps_value and replace the masked original, got:\n{}".format(reveal_src))
+            failed += 1
+
     finally:
         os.chdir(original_dir)
         shutil.rmtree(temp_dir, ignore_errors=True)
 
@@ -91,7 +91,7 @@
     predbat_log_file_prev,
     is_secret_key,
 )
-from utils import is_data_numerical, ROOT_YAML_KEY, SECRET_MASK, YAML_DUMP_WIDTH, parse_yaml_path, update_nested_yaml_value  # noqa: F401 - re-exported: moved to utils.py, agent_tools.py/chat_tools.py must not import from web.py
+from utils import is_data_numerical, ROOT_YAML_KEY, SECRET_MASK, YAML_DUMP_WIDTH, parse_yaml_path, resolve_nested_yaml_value, update_nested_yaml_value  # noqa: F401 - re-exported: moved to utils.py, agent_tools.py/chat_tools.py must not import from web.py
 from const import TIME_FORMAT, TIME_FORMAT_DAILY, TIME_FORMAT_HA, MANUAL_RATE_MAX_MINUTES, MANUAL_TIME_MAX_MINUTES
 from predbat import THIS_VERSION_DISPLAY
 from component_base import ComponentBase
@@ -514,6 +514,7 @@ async def start(self):
         app.router.add_get("/log", self.html_log)
         app.router.add_get("/apps", self.html_apps)
         app.router.add_post("/apps", self.html_apps_post)
+        app.router.add_get("/apps_value", self.html_apps_value)
         app.router.add_get("/charts", self.html_charts)
         app.router.add_get("/config", self.html_config)
         app.router.add_get("/entity", self.html_entity)
@@ -2950,9 +2951,10 @@ def render_type(self, arg, value, parent_path="", row_counter=None):
                     actions_cell += self.render_delete_button(nested_row_id)
 
                 raw_value = self.resolve_value_raw(key, nested_value)
+                secret_attr = self.secret_row_attr(key, nested_value, "'")
 
                 if nested_row_id is not None:
-                    text += f"<tr id='nested_row_{nested_row_id}' data-nested-path='{nested_path_attr}' data-nested-original='{html_module.escape(str(raw_value))}'><td><b>{key}: </b></td><td id='nested_value_{nested_row_id}'>{self.render_type(key, nested_value, nested_path, row_counter)}</td><td>{actions_cell}</td></tr>\n"
+                    text += f"<tr id='nested_row_{nested_row_id}' data-nested-path='{nested_path_attr}' data-nested-original='{html_module.escape(str(raw_value))}'{secret_attr}><td><b>{key}: </b></td><td id='nested_value_{nested_row_id}'>{self.render_type(key, nested_value, nested_path, row_counter)}</td><td>{actions_cell}</td></tr>\n"
                 else:
                     text += "<tr><td><b>{}: </b></td><td colspan='2'>{}</td></tr>\n".format(key, self.render_type(key, nested_value, nested_path, row_counter))
             text += self.render_add_row("addDictKey", [dict_path], "Add setting", row_counter)
@@ -3752,6 +3754,41 @@ def is_editable_value(self, value):
             return len(value) > 0 and any(self.is_editable_value(item) for item in value)
         return False
 
+    def secret_row_attr(self, key, value, quote):
+        """
+        Return the data-secret attribute for a row whose value html_apps() served masked, else "".
+
+        The page holds SECRET_MASK for a credential rather than the credential itself, so the
+        browser's Edit has to fetch the real value (/apps_value) before it can offer it - this flag
+        is how it knows to. Only a scalar leaf is flagged: mask_secret_args() replaces a secret
+        key's whole value, list or not, so this is the row that holds the mask.
+        """
+        if value == SECRET_MASK and is_secret_key(key):
+            return " data-secret={}1{}".format(quote, quote)
+        return ""
+
+    async def html_apps_value(self, request):
+        """
+        Return the real value of one apps.yaml setting, for the /apps editor's Edit on a credential.
+
+        html_apps() serves credentials masked, so without this Edit could only offer "xxx" - the
+        user could neither see nor amend the key, and saving it back unchanged is refused. Only
+        the one path asked for is returned, and only when it is a single value, so the page itself
+        still never carries credentials and a whole container cannot be pulled in the clear. The
+        unmasked /debug_apps download already exposes the same values behind the same access.
+        """
+        path = request.query.get("path", "")
+        if not path:
+            return web.json_response({"success": False, "message": "No path given"})
+        try:
+            value = resolve_nested_yaml_value(self.args, path)
+        except (KeyError, TypeError, ValueError) as e:
+            return web.json_response({"success": False, "message": f"Path {path} not found: {str(e)}"})
+        if not self.is_editable_value(value) or isinstance(value, list):
+            return web.json_response({"success": False, "message": f"{path} is not a single value that can be edited here"})
+        leaf = [segment for segment in parse_yaml_path(path) if not segment.startswith("[")][-1]
+        return web.json_response({"success": True, "value": str(self.resolve_value_raw(leaf, value))})
+
     def resolve_value_raw(self, arg, value):
         if isinstance(value, str) and "{" in value:
             text = self.base.resolve_arg(arg, value, indirect=False, quiet=True)
@@ -3870,8 +3907,8 @@ async def html_apps(self, request):
                         # For numerical values, show edit button
                         actions_cell = f'<button class="edit-button" onclick="editValue({row_id})">Edit</button>'
 
-                text += '<tr id="row_{}" data-arg-name="{}" data-original-value="{}"><td>{}</td><td id="value_{}">{}</td><td>{}</td></tr>\n'.format(
-                    row_id, arg_attr, html_module.escape(str(raw_value)), arg, row_id, self.render_type(arg, value, "", row_counter), actions_cell
+                text += '<tr id="row_{}" data-arg-name="{}" data-original-value="{}"{}><td>{}</td><td id="value_{}">{}</td><td>{}</td></tr>\n'.format(
+                    row_id, arg_attr, html_module.escape(str(raw_value)), self.secret_row_attr(arg, value, '"'), arg, row_id, self.render_type(arg, value, "", row_counter), actions_cell
                 )
             row_id += 1
 
 
@@ -940,10 +940,33 @@ def get_apps_js(all_states_json):
     updateChangeCounter();
 }
 
-function editValue(rowId) {
+async function revealSecretValue(row, attribute, path) {
+    // The page serves credentials masked, so a data-secret row's original is the placeholder,
+    // not the key - fetch the real value once and make it the row's original, so the input
+    // offers the real key and saving it unchanged is not seen as a change
+    try {
+        const response = await fetch('./apps_value?path=' + encodeURIComponent(path));
+        const result = await response.json();
+        if (!result.success) {
+            showMessage(result.message, 'error');
+            return false;
+        }
+        row.dataset[attribute] = result.value;
+        delete row.dataset.secret;
+        return true;
+    } catch (error) {
+        showMessage('Could not load the value to edit: ' + error.message, 'error');
+        return false;
+    }
+}
+
+async function editValue(rowId) {
     const row = document.getElementById('row_' + rowId);
     const valueCell = document.getElementById('value_' + rowId);
     const argName = row.dataset.argName;
+    if (row.dataset.secret === '1' && !(await revealSecretValue(row, 'originalValue', argName))) {
+        return;
+    }
     const originalValue = row.dataset.originalValue;
 
     // Check if there's a pending change, use that value instead of original
@@ -1636,10 +1659,13 @@ def get_apps_js(all_states_json):
     updateChangeCounter();
 }
 
-function editNestedValue(rowId) {
+async function editNestedValue(rowId) {
     const row = document.getElementById('nested_row_' + rowId);
     const valueCell = document.getElementById('nested_value_' + rowId);
     const nestedPath = row.dataset.nestedPath;
+    if (row.dataset.secret === '1' && !(await revealSecretValue(row, 'nestedOriginal', nestedPath))) {
+        return;
+    }
     const originalValue = row.dataset.nestedOriginal;
 
     // Check if there's a pending change, use that value instead of original