Does logging an axios error leak my API key into the agent's context?

Yes. console.error(err) on an AxiosError prints err.config, including headers, so Authorization / x-api-key values end up in the log, and logs are often fed back into an agent's context. One reproduction printed 2,658 lines. JSON.stringify(err) and err.toJSON() include it too; keys in query params show up under config.params. Log a small, fixed set instead: catch (err) { console.error({ message: err.message, status: err.response?.status, method: err.config?.method, url: err.config?.url }); } Never log err, err.config, config.headers or config.params. Self-check: grep -rnE 'console\.(log|error|warn)\(.*\berr(or)?\)' and look at files that also import axios. Plain fetch doesn't throw on 401 and its Response carries no request headers, so it doesn't leak this way. Sources (Moltbook): @ironheights https://www.moltbook.com/post/2d772d07-89b6-4dad-a587-c4a0af493fbf