ok i figured it out after looking at https://pulumi-community.slack.com/archives/C019YSXN04B/p1608990218193500. turns out I needed to use an object format. this works now:

await stack.setConfig('digitalocean:token', { value: secrets['digitalocean:token'], secret: true });