Depends a little whether you just need a token you can query for in a separate field, or something you can actually decrypt and read the id
Assuming the latter, you need to create a key, store it somewhere and then use it to encrypt and decrypt
e.g. create a key that is the right length and store the string somewhere safe:
Datetime dt = system.now();
The Setup Audit Trail will contain the information you're looking for and you're able to download the last 180 days of changes.
The history shows the 20 most recent setup changes made to your org.
It lists the date of the change, who made it, and what the change was.
If a delegate, like an admin or customer support representative, makes
a setup ...
There are a few products that can help you with Org comparison. For example, if you use Workbench or ANT (Metadata Deployment tool), you can retrieve the Org metadata as XML and use a file compare tool like BeyondCompare to figure out the differences. It is free/ cheap and it will work.
If you need a dead simple tool, please check out Snapshot. ...
NO, the workflows, process builders and triggers do NOT need to be manually activated. What the documentation is telling you (implicitly) is that the DML required to mask the data (by SFDC) will not cause any side effects via the execution of automation that normally occurs upon DML:
Lightning Flow (before update, after update)
Try a "Named Credential"
If that doesn't fit this use-case another option is creating a custom object to store Client Id, Consumer Secret, and any other tokens using text fields that you encrypt and mask. You can set text fields to mask with asterisks and encrypt the field data, then query the custom object records for your client Id and consumer secret in ...