"- API tokens are now stored only as hashes, which limits the impact of any similar incident."

WTF were they not already?

[flagged]

The number of systems that will show me the API token more than once makes me realize that many haven't figured out it is just a long password and should be treated exactly as such.

And you're absolutely right to push back on that.