Providers API accepts API key in request body without redaction

[hariew]

Providers API accepts API key in request body without redaction

Severity: Medium
File: backend/app/modules/platform/providers_api.py:50

The SetKeyRequest model accepts apiKey as a plain string in the request body. While FastAPI doesn't log request bodies by default, if logging is enabled or request tracing is configured, API keys could be written to logs in plaintext.

class SetKeyRequest(BaseModel):
    providerName: str
    apiKey: str

Why it matters

API keys stored in request logs or traces could be exposed to developers, support staff, or through log aggregation systems. The key should be redacted in any logging or tracing.