@tmk Confirmed bug on our side; thanks for the report.
The plugin declared its secret with a random default in the config schema. That expression runs when the module is imported, so every xo-server process computes a different one, and xo-server never writes back the values ajv fills in from schema defaults. So if you copied the secret out of the plugin form without saving the configuration, scraping worked until the next restart, and Prometheus started getting 401s.
Fix is here: https://github.com/vatesfr/xen-orchestra/pull/10290. The random default is gone. The secret is generated once on the first load and saved through the plugin configuration, so it survives a restart. If you already have one saved, it's left alone.
Once it's merged it'll be on master for people building from sources, and it'll reach XOA in the next release.