Following up: the Vercel Support Agent reports that pre-ingestion/storage redaction of specific Runtime Logs query parameters is unsupported across all plans.

The Agent offered a support case, but the form directs Hobby users back to Community for Observability → Logs support.

Could a Vercel staff member confirm the redaction limitation and clarify whether Hobby’s one-hour retention means query availability or deletion of underlying request metadata, particularly given the documented availability of older logs after upgrading?

My reproduction used fake values only. Deployed OAuth remains disabled pending clarification.

Not staff, so I can't speak to Vercel's storage. But with PKCE, a logged code and state are low value on their own, and you can make that hold in your app:

• The code can't be redeemed alone. Spotify's PKCE token request needs the code_verifier your app generated (that interception case is why RFC 7636 exists). Keep the verifier out of the URL: store it in an httpOnly, Secure, SameSite=Lax cookie, delete it after the exchange, and never log cookies.
• It's single-use and short-lived. RFC 6749 §4.1.2 says a code must expire shortly (10 min max recommended) and must not be used twice. Exchange it in the callback and never retry with the same code.
• state is only a CSRF check. Compare it to a cookie value, then discard it.
• Redirect to a clean URL after the exchange so the code isn't left in the address bar or sent onward in a Referer.

1
// app/api/spotify/callback/route.ts (sketch)
2
const verifier = (await cookies()).get('pkce_verifier')?.value
3
if (!verifier || state !== (await cookies()).get('oauth_state')?.value)
4
  return new Response('Invalid', { status: 400 })
5
// POST code + verifier to the token endpoint, store tokens server-side,
6
// delete both cookies, then redirect('/')

To verify: after a real login, replay the exact callback URL from the logs in another browser. It should fail (no verifier cookie, code already used).

Vercel's docs list 1 hour of runtime logs on Hobby; whether that means deletion is for staff to confirm.