doppler.ServiceToken works fine on create but panics on get/refresh

[GeoffMillerAZ]

Summary

When a ServiceToken is created, like many token generation algorithms, they can only be read on creation. If you ever try to read the value again, you will get an API error. You must create a new token to get a token value if you didn't save the value.

Resource in question:

https://www.pulumi.com/registry/packages/doppler/api-docs/servicetoken/

Error

pulumi:pulumi:Stack: (same)
[urn=urn:pulumi:backend.myenv::backend::pulumi:pulumi:Stack::backend-backend.myenv]
error: Preview failed: refreshing urn:pulumi:backend.myenv::backend::doppler:index/secret:Secret::mytoken-> secret: 1 error occurred:

• One or more secret fields are restricted: [raw computed]. You must use a service account or service token to manage these > resources. Otherwise, Terraform cannot fetch these restricted secrets to check the validity of their state.

Thoughts

Maybe the get/refresh operations should simply get the metadata about the resource and/or check if it exists with the same name. If there is a hash of the secret, that could be good to check against it to see if the resource needs to be recreated.