Skip to main content
An API key or signing secret never leaves a client except on the wire.

Never in an error

No message, stack, property or cause holds a key.

Never in a log

Response hooks and log lines get no header, query or body.

Never in a dump

Inspecting, printing or serializing a client shows no key.

Never to another site

Redirects are never followed, so a key never reaches another origin.
Keys stay out of exceptions and their traces, dumps, exports, JSON, log context, and the ResponseReceived / ConnectionFailed events Telescope reads (which carry no signature either, nor a write’s bodies). Read one with $key->token() / $key->signingSecret() when you must.

Queue the slug, never the client

serialize() of anything holding a key refuses, so a Site or a client can’t land in a queued job, a cache or a session.

Resolve it in the job

Guzzle’s debug output is refused: it would print every header, the key among them. Watch calls through log_channel, Telescope or Attract::fake().
One place does see the key. Laravel’s RequestSending event, Http::fake() callbacks and Http::recorded() get the request as sent, Authorization included. A listener or test must never log their headers.

Next: Agent Skills

The Agent Skill each SDK ships, installed with one command.