A user reported that API key hashes appear in plain text in Admin > Logs, raising security concerns, potentially referencing a past issue where moderators could access admin API keys this issue. Another user suggested adding a permission to restrict viewing such data. However, RGJ and tshenry clarified that what’s logged is the key hash — not the actual API key — and confirmed via testing that the real API key remains hidden, with only a truncated version and hash visible. The issue appears to be a misunderstanding rather than a security flaw.
This may be a regression of this issue.
When an Admin created an API key, the key hash is displayed in plain text in Admin > Logs and viewable by me (moderator). While most users won’t have access to the Admin > Logs, I’d still expect values like that to be further restricted.
Maybe induct an extra permission that one needs to be able to see this in plain text
The key hash is not the API key.
Yep. We just did a quick test on latest tests-passed and everything looks fine. You will see the truncated key and the key hash, but the actual API key is not visible in the logs.
This topic was automatically closed after 24 hours. New replies are no longer allowed.