The OpenAI-compatible client scrubs only the literal key from a provider's error text: a 4xx body that echoes the key JSON-escaped in a field other than error.message (for example {"detail":"bad key sk-abc\/def+ghi"}) falls to the raw body, the scrub misses the escaped form, and the key reaches the error and stderr. The provider-reported model is recorded and quoted in the denylist refusal unscrubbed as well.

The OpenAI-compatible client scrubs only the literal key from a provider's error text: a 4xx body that echoes the key JSON-escaped in a field other than error.message (for example {"detail":"bad key sk-abc\/def+ghi"}) falls to the raw body, the scrub misses the escaped form, and the key reaches the error and stderr. The provider-reported model is recorded and quoted in the denylist refusal unscrubbed as well.

Grounds

• pursued: no representation of the key reaches an error or a result whatever encoding a provider echoes it in; shown wrong by a provider body that carries the key in an encoding neither decoded nor listed in keyForms, which TestNoRepresentationOfTheKeySurvivesInAnError would then need adding and would fail on