fix(logging): redact common credential aliases

CHANGELOG.md

@@ -10,6 +10,7 @@ Versioning: [Semantic Versioning](https://semver.org/spec/v2.0.0.html)
 ## [Unreleased]
 
 ### Fixed
+- **v2 request logging**: Redact common OAuth and Google API credential aliases from nested debug-log kwargs without hiding non-secret token configuration. ([#2490](https://github.com/567-labs/instructor/issues/2490))
 - **v2 message handling**: Preserve caller-owned message lists and nested content across request preparation and retries for OpenAI-compatible, Cohere, Mistral, OpenRouter, Writer, and xAI handlers. ([#2417](https://github.com/567-labs/instructor/issues/2417), [#2428](https://github.com/567-labs/instructor/issues/2428))
 - **v2 JSON extraction**: Prefer the final complete top-level JSON value in text responses and retain every JSON object when multiple objects arrive in one streaming chunk.
 - **v2 schemas**: Treat fields with Pydantic `default_factory` values as optional in generated OpenAI tool schemas.

instructor/v2/core/response.py

@@ -70,7 +70,17 @@ class User(BaseModel):
 T = TypeVar("T")
 
 _SENSITIVE_KEYS: frozenset[str] = frozenset(
-    {"api_key", "api_secret", "authorization", "token", "x_api_key"}
+    {
+        "access_token",
+        "api_key",
+        "api_secret",
+        "authorization",
+        "client_secret",
+        "refresh_token",
+        "token",
+        "x_api_key",
+        "x_goog_api_key",
+    }
 )
 
 

tests/coverage/test_core_response_coverage.py

@@ -3,6 +3,7 @@
 import importlib
 import json
 from collections.abc import Callable
+from copy import deepcopy
 from types import SimpleNamespace
 from typing import Any, cast
 
@@ -107,6 +108,45 @@ def test_redaction_handles_tuples_without_mutating_input() -> None:
     assert kwargs["metadata"][0]["api-secret"] == "private"
 
 
+@pytest.mark.parametrize(
+    "credential_key",
+    [
+        "access_token",
+        "refresh-token",
+        "X-Goog-Api-Key",
+        "Client-Secret",
+        "api_key",
+        "Authorization",
+    ],
+)
+def test_redaction_hides_common_credential_aliases(
+    credential_key: str,
+) -> None:
+    kwargs = {
+        "extra_headers": {
+            credential_key: "private",
+            "x-request-id": "request-123",
+        }
+    }
+    original = deepcopy(kwargs)
+
+    result = _redact_kwargs(kwargs)
+
+    assert result["extra_headers"][credential_key] == "[redacted]"
+    assert result["extra_headers"]["x-request-id"] == "request-123"
+    assert kwargs == original
+
+
+def test_redaction_preserves_non_secret_token_configuration() -> None:
+    kwargs = {
+        "max_tokens": 256,
+        "token_budget": 1_000,
+        "headers": {"content-type": "application/json"},
+    }
+
+    assert _redact_kwargs(kwargs) == kwargs
+
+
 def test_registry_load_failure_is_best_effort(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None: