Wraps the CDP api_key/api_secret pair so it can sit in a GenServer's state without printing in full the moment that process crashes.

The incident this closes

Feed and Socket both hold :credentials for their entire lifetime — Feed to keep re-signing subscribes across reconnects and resubscribe sweeps, Socket to sign the JWT for every authenticated subscribe/4. Neither is optional: both need the raw secret to keep working. But OTP's default crash report prints a GenServer's state in full, and a plain map field prints every key including the secret ones — verified against a real crash of an equivalent process holding %{api_key: "...", api_secret: "..."} as a bare state field: the log line came back with both values in cleartext.

A Process.flag(:sensitive, true) was tried too, on the theory that it suppresses state in crash reports. It does not — the same crash, with the flag set, printed the same cleartext state. It disables tracing (:sys.get_state/1, :dbg), which is a different guarantee and not this one.

What DOES work, verified the same way: a struct whose Inspect implementation is derived with except: naming every secret field. Kernel.inspect/1 — which is what both the crash-report formatter AND a FunctionClauseError's printed argument list go through — honours a struct's Inspect protocol even when the struct is nested inside an otherwise-plain state map, or is itself the argument a failed function clause is being reported against. Wrapping the credential pair in this struct, once, at the point it enters a long-lived process, and letting the struct itself (never an unwrapped copy) flow into every downstream call closes both leaks:

• a crash of Feed or Socket prints credentials: #DpExchange.Coinbase.Credentials<...> rather than the key pair;
• DpExchange.Coinbase.Auth.jwt/2 and every function that only forwards this value opaquely (Socket.subscribe/4, the resubscribe/reconcile handle_info messages that carry it, default_alias_map_source/2) keep working unchanged, because a struct is a map — %{api_key: k, api_secret: s} = credentials still binds k and s to the real values inside Auth.jwt/2, which is the one place they need to be raw, and that binding is never itself stored or logged.

Why nil stays nil

Feed.init/1's active_channels/1 and Socket's subscription_message/3 both branch on "no credentials were supplied" by matching literal nil — Coinbase's credential-less callers pass no :credentials option at all, and Keyword.get/2 answers nil rather than %{}. wrap/1 preserves that: only a map gets struct-ified, so the "authenticated channels are unreachable" branch still fires exactly when it always did.

The wrap lives in child_spec/1, so bypassing it bypasses the redaction

child_spec/1 is where wrap_opt/1 is applied, because a supervisor captures the {module, :start_link, [opts]} MFA before start_link/1 or init/1 ever runs — see wrap_opt/1's own doc. A consumer who uses the supported {DpExchange.X, credentials: ...} child form gets the redaction for free.

A consumer who builds the child spec themselves does not, and upgrading this package will not change that: their supervisor stores the raw map and OTP renders it on the next crash, with nothing from this package on that path to intervene. It is a real path with a real reason — a caller needing a delivery target other than the supervisor has to reach start_link/1 directly — so wrap/1 and wrap_opt/1 are public for it. Reported by a consumer who went looking for their canary in supervisor state after upgrading and found it; the natural assumption, "upgraded, therefore redacted", is wrong there.

The same applies to a host that reshapes a credential before handing it over — mapping its own key names into this venue's and returning a bare map re-introduces the leak downstream of anything this package can reach.