If you have a site password saved in Chrome, and go to add an External Tool, the browser will enter your username under Tool URL and your password under Shared Secret. The thing that makes it extra confusing is that it doesn't appear that there is a password entered under Shared Secret unless you click the eye to reveal it (as it, it is in it's empty appearing state).

This seems to be a very recent change, as it only appeared when I client updated to 3.11.10+. I can reproduce it on qa.moodle.com as well.

I have not confirmed, but I believe this may be related to the changes from MDL-74814.