Hello for some reason if I provide my own auth keys and secret and disable cardinals masking I still cant get my oauth secrets out. Its still masked. It worked few days before. Is this some widespread outage?

As part of incident response, the Get Connected Account by ID API now redacts access tokens for all accounts, regardless of your "mask secrets" setting. This is intentional and described in the bulletin under Things we have done so far: https://composio.dev/blog/composio-may-2026-security-incident.

Is this a permanent change? Or emergency fix? That would change how we architect the product

hey we would prefer for you to use proxy execute, but if this doesn't work for you we can work with you in a 1-1 basis once things are stabilized to give access to this functionality

I see I am actually fine with it as long the bearer auth for slack is not deprecated (which according to the docs it is now). We can manage our own keys. For example we are running hermes instances for our customers that require slack socket mode enabled so you could not use

proxy

for that. We need the real keys and custom auth present.

interesting okay we can likely support this with like an ip whitelist or a secondary key exchange or something of this sort

@Rahul Hi! Has there been any progress in working out solutions for this? We are also currently experiencing problems due to the fact we lost access to the access toen through the endpoint. We'd be happy to implement IP allowlisting.

This is literarly ruining this product for us. Any updates?

Hi there, Sorry for the disruption here, and to be clear this isn't an outage on your project. As part of our May 2026 security incident response, we're currently applying a platform-wide redaction to access/refresh tokens and OAuth secrets returned by the Get Connected Account API. Right now that override sits above the per-project "mask secrets" setting, so even with masking off on your own custom auth config, the secrets still come back redacted. That's why the behavior changed a few days ago. From here: • For most cases we'd recommend Proxy Execute, which covers the same use case without reading raw tokens: https://docs.composio.dev/docs/proxy-execute • For your Slack socket-mode setup that genuinely needs the real keys, as mentioned earlier in the thread we can look at a per-project exception to lift the override once things stabilize. That would be handled on a 1-1 basis and at your own security risk, since it re-exposes raw tokens for that project. If you'd like to go the exception route, just reply here confirming and we'll pick it up as things stabilize. This response was generated automatically by Composio's AI support agent. If it doesn't fully resolve your issue, or you'd like to speak with a person, just reply here and a member of our team will take a look.

I'd like to be considered on that exception route.

hey @alessandra, we'd love to solve this for you and wanted to understand the use case & blockers. Would you mind getting on a quick call to discuss more? https://calendly.com/d/dtnc-nb2-h96

Of course. Booking some time.