The access key configured are persisted in clear text. For example when using Configuration as Code the key is exposed: https://github.com/jenkinsci/metrics-plugin/blob/metrics-4.0.2.6/src/test/resources/jenkins/metrics/configuration-as-code.yaml

The key should be made a Secret