This message was deleted.

Have you tried piping the value to pulumi config? eg for OSX it would be

pbpaste | pulumi config --config-file path/to/config.yaml set --secret okta_metadata

I did not, but hey that worked!