diff --git a/internal/api/v1/handlers.go b/internal/api/v1/handlers.go
index 3507d9a..77ec9b7 100644
--- a/internal/api/v1/handlers.go
+++ b/internal/api/v1/handlers.go
@@ -331,9 +331,7 @@ func (api *API) GetGlobalSecrets(w http.ResponseWriter, r *http.Request) {
 
 	showRaw := r.URL.Query().Get("raw") == "true"
 	if !showRaw {
-		for key := range secretsMap {
-			secretsMap[key] = "********"
-		}
+		redactSecrets(secretsMap)
 	}
 
 	respondJSON(w, http.StatusOK, secretsMap)
@@ -464,6 +462,18 @@ func (api *API) NetworkResolveHandler(w http.ResponseWriter, r *http.Request) {
 	})
 }
 
+// redactSecrets replaces leaf string values with "********" while preserving
+// map structure so the UI can check which keys exist.
+func redactSecrets(m map[string]any) {
+	for key, val := range m {
+		if nested, ok := val.(map[string]any); ok {
+			redactSecrets(nested)
+		} else {
+			m[key] = "********"
+		}
+	}
+}
+
 // getCloudflareToken reads the Cloudflare API token from global secrets
 func (api *API) getCloudflareToken() string {
 	secretsPath := filepath.Join(api.dataDir, "secrets.yaml")