{"version":"2.1.260","anchor":"custom-inference-headers-now-blocked-from-carrying-credentia","canonical_anchor":"custom-inference-headers-now-blocked-from-carrying-credentia","heading":"Custom inference headers now blocked from carrying credentials, with legacy key deprecated","tier":"notice","area":"Auth","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.260\/e\/custom-inference-headers-now-blocked-from-carrying-credentia","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.260","markdown":"### Custom inference headers now blocked from carrying credentials, with legacy key deprecated\n\nCustom inference headers now explicitly warn against putting credentials in them.\n\nThe `inferenceCustomHeaders` field's guidance now explicitly warns not to put API keys, bearer tokens, or other credentials in it, a change from the previous guidance allowing generic per-request headers including auth. The legacy flat key `inferenceGatewayHeaders` is now marked deprecated, with an explicit message describing its fallback effect.\n\n- Area: Auth\n- Names: `inferenceCustomHeaders`, `inferenceGatewayHeaders`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5"}