From c360cbd493801e01a4a1f106ed55bfb8bf4dad94 Mon Sep 17 00:00:00 2001
From: YouXam <youxam@outlook.com>
Date: Thu, 1 Jan 2026 15:17:37 +0800
Subject: [PATCH] fix: hide apiKey

---
 server/api-client.ts | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/server/api-client.ts b/server/api-client.ts
index 4b1ac55..6282435 100644
--- a/server/api-client.ts
+++ b/server/api-client.ts
@@ -164,6 +164,11 @@ export class ApiClient {
     return data.data;
   }
 
+  private sanitizeApiKeyItem(item: ApiKeyListItem): ApiKeyListItem {
+    const { apiKey, ...rest } = item;
+    return rest;
+  }
+
   private async fetchUsageBatch(keyIds: string[]): Promise<Record<string, ApiKeyBatchStats>> {
     await this.ensureValidToken();
 
@@ -226,12 +231,13 @@ export class ApiClient {
     const usageStats = await this.getUsageStats(shareableItems.map(item => item.id));
 
     return shareableItems.map((item) => {
+      const sanitizedItem = this.sanitizeApiKeyItem(item);
       const stats = usageStats.get(item.id);
       const cost = Number(stats?.cost ?? 0);
       const formattedCost = stats?.formattedCost ?? `$${cost.toFixed(2)}`;
 
       return {
-        ...item,
+        ...sanitizedItem,
         usage: {
           total: {
             cost,