The section on

Structured Configuration

shows how to set a secret as part of structured config. But I’m missing what the type should be in my custom TS interface. https://www.pulumi.com/docs/intro/concepts/config/#structured-configuration

It would be the underlying type. If you want to treat it as a secret in the Pulumi program code, you'll have to retrieve the whole structure as a secret (

config.requireSecretObject<YourInterface>("yourkey");

)