The custom provider edit form seeded the API key input with the masked
value (e.g. "abc•••••wxyz") returned by the sanitized GET. Saving or
running "Detect Models" without retyping echoed that mask back — the
probe endpoint rejects it and a persisted mask broke HTTP header
encoding. The field now starts blank with a "leave blank to keep" hint;
an empty field omits apiKey so the stored credential is preserved.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
0077b10ef7