The bakery key should be set in settings.php (or somewhere similar) and then not shown/configurable on the admin screens. Showing it allows someone who gains access to a subsite to be able to break into a master site as any user they want to be.
Active
3.0
Code