@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    private String apiUser;
    private String apiPassword;

    @Autowired
    public WebSecurityConfig(
            @Value("${web.security.api.user}") String apiUser,          // stored in plain text in application.properties
            @Value("${web.security.api.password}") String apiPassword)  // no reference in plaintext
    {
        this.apiUser = apiUser;
        this.apiPassword = apiPassword;
    }

    .....

}