# boolean_smtp_sensitive_keys

> Filters the exact settings-key names whose values are encrypted at rest, masked in REST responses and redacted from logs.

Filter · Tier A · Since 1.0.0

Keys containing `key`, `secret`, `password`, `token` or `username` are always secrets; a custom transport whose credential fields are named differently declares them here. The names returned are added to the built-in set: a listener can add keys, never make a built-in secret visible.

## Signature

```php
add_filter( 'boolean_smtp_sensitive_keys', $callback, 10, 1 );
```

## Parameters

| Name | Type | Description |
| --- | --- | --- |
| `$keys` | `list<string>` | Exact key names treated as secrets. Default `['webhook_url']`. |

**Returns** `list<string>` — The key names to add to the built-in set.

## Fires in

- [app/Services/Encryption/AesEncryptor.php:358](https://github.com/booleanpress/boolean-smtp-src/blob/main/app/Services/Encryption/AesEncryptor.php#L358) — `BooleanSmtp\Services\Encryption\AesEncryptor::sensitiveKeys()`

## Example

```php
add_filter( 'boolean_smtp_sensitive_keys', function ( array $keys ) {
    return $keys;
}, 10, 1 );
```