The replacement, as a literal.

Do not hard-code a secret here. A literal written into the step configuration is persisted with the build and shown by Pipeline visualisation, so it is readable by anyone who can read the job.

Referring to a credential through an environment variable is safe, and is a good option when one credential supplies more than one value:

withCredentials([usernamePassword(credentialsId: 'my-secret',
                                  usernameVariable: 'MY_USER',
                                  passwordVariable: 'MY_PASS')]) {
    configSubstitution(targets: [[files: ['*.json'], format: 'json',
        substitutions: [
            [path: 'user', value: env.MY_USER, type: 'string'],
            [path: 'pass', value: env.MY_PASS, type: 'string']
        ]]])
}

Inside withCredentials the value is masked in the build log, and Pipeline replaces it with ${MY_PASS} before storing the step arguments, so it is not persisted. For a single Secret Text, the credential field below is simpler.

Always written as text here; how it is emitted into the file is decided by the value type.