A secret goes only into a request header

The proxy puts a secret's value in the header you set for it, or, with none set, in the credential headers (Authorization, x-api-key, x-goog-api-key, api-key, xi-api-key, x-subscription-token and private-token), never in a URL's path or query or another header, where the placeholder now goes out as it is. Stored OpenAI, Anthropic and Gemini keys keep working; code that put a placeholder in a URL should send it in a header. See secrets sandboxes never see.