> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trynito.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy-Safe Logging

> Log request IDs and metadata, never bodies or credentials.

## Log the Request ID

Every response carries `X-Request-ID`: the one you sent (up to 128 characters, sanitized) or a fresh one (16 random bytes, hex). It correlates a user report, your application log, and a gateway-side lookup without storing content. Set your own on the way in so the IDs match end to end.

```shellscript wrap theme={"theme":{"light":"github-light","dark":"github-dark"}}
# Good: correlation-friendly, content-free
level=info event=inference.done request_id=<X-Request-ID> model=<model-id> \
  status=200 latency_ms=812 prompt_tokens=... completion_tokens=...
```

## Metadata, Not Content

Most production issues are debuggable from:

* The request ID.
* The model ID requested.
* HTTP status and `finish_reason` (`stop`, `length`, `tool_calls`, `error`).
* Token counts from `usage`, latency, whether streaming was used.
* The error `code` and `message` from the envelope.

Content logging belongs behind a deliberate, access-controlled, time-bounded process, never on by default.

## Never Log the Credential

Do not log the `Authorization` header or the key. Many HTTP libraries dump full headers on error; redact before anything is written. Allowlist the fields you log; a blocklist fails open. See [Secure API Key Handling](/api/features/best-practices/secure-api-key-handling).

## Match the Gateway

Nito stores nothing you send or receive: prompts, completions, reasoning, tool payloads, and attachment content are not persisted, and inference responses carry `Cache-Control: no-store`. Logs that capture full content become the one place the data sits at rest. See [Data Retention and Visibility](/privacy/data-retention-and-visibility).

## Checklist

* `X-Request-ID` on every call, set on the way in.
* Metadata, not bodies.
* `Authorization` never logged; allowlist redaction.
* Content logging as a controlled exception.

## Related

<CardGroup cols={2}>
  <Card title="Request IDs" icon="money-bill-wave" href="/api/api-reference/overview/request-ids">
    The `X-Request-ID` header.
  </Card>

  <Card title="Privacy Overview" icon="gears" href="/privacy/overview">
    The four levels.
  </Card>

  <Card title="Data Retention and Visibility" icon="signal-stream" href="/privacy/data-retention-and-visibility">
    What is kept, who sees what.
  </Card>

  <Card title="Secure API Key Handling" icon="binary-lock" href="/api/features/best-practices/secure-api-key-handling">
    Keys.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.