How do I stop my API key from appearing in my app's logs?

Keys often leak through logs, because a request's headers get printed in full.

• Don't log headers wholesale. Log the method, path, status and error code.
• Redact Authorization and any string starting with clsk_.
• Log ids instead: the Model API's X-Request-Id or the Agent API run id.
• Check error trackers too; some capture headers by default.

Good to know#

• Never put a key in front-end code, a mobile app, a public repo or a screenshot.
• Give each integration its own key with only the permissions it needs.
• If a key may have leaked, revoke it first, then replace it.

Learn more#

• Limits and best practices
• API keys guide
• Abuse policy

Still need help?#

• General support: support@clatterlabs.com or team@clatterlabs.xyz
• Infrastructure questions, or permanent deletion of your data (your whole account or one service): infrastructure@clatterlabs.xyz

We usually reply within the first hour, and always within 24 hours. A full support team is with you.