MCP error text showed a Bearer token: rotate the Sume API key

If an MCP error message in a Claude Code session or log showed a Sume API key, treat the key as exposed and replace it. Claude Code 2.1.286 fixed two masking bugs: error messages that showed a credential's value when "Bearer" or "Basic" came before its key name, and percent-encoded Bearer tokens that were only partly masked (Claude Code changelog, read 2026-10-04). The fix stops new leaks; it does not clean logs you already saved.

What to look for

Search saved transcripts, CI logs and bug reports from before the update for the Authorization header form. A Sume API key can be sent as Authorization: Bearer <key> or as x-api-key, so search for both.

• Terminal scrollback or CI output from a failed MCP call.
• Debug logs and exported transcripts attached to tickets.
• Shared screenshots of an error banner.

How to rotate on Sume

Create a new key at the API Keys page in the dashboard and move every client to it. Sume's docs describe this for older keys that lack new scopes: scopes cannot be added to an existing key, so you create a new one and rotate to it (Agent Completions). The same move replaces an exposed key.

Keep keys out of logs from now on

Sume's safe-automation guidance lists what logs should hold: request ids, job ids when needed, high-level status and sanitized media metadata. It lists as unsafe API keys, signed URLs, raw private media URLs and excessive user content (Safe automation).

Prefer OAuth for interactive clients, so no long-lived key is in a header at all. For automation, read the key from an environment variable that your runner masks, and never echo the request headers.

Check what the old key could do

An API key to the hosted MCP gets the full tool set, including paid tools. After replacing it, look at recent usage and jobs for calls you did not make, and keep a spend ceiling in your prompts with max_spend_usd, since that cap is enforced only when you send it.