services.strongswan-swanctl.swanctl.secrets.token.<name>.handle

Hex-encoded CKA_ID or handle of the private key on the token or TPM, respectively.