diff --git a/app/api/admin/ai-providers/route.ts b/app/api/admin/ai-providers/route.ts
index 98b11b5..0e53d69 100644
--- a/app/api/admin/ai-providers/route.ts
+++ b/app/api/admin/ai-providers/route.ts
@@ -26,6 +26,21 @@ const updateProviderSchema = z.object({
   isEnabled: z.boolean().optional(),
 });
 
+function maskApiKey(apiKey?: string) {
+  if (!apiKey) return undefined;
+  if (apiKey.length <= 8) return "****";
+  return `${apiKey.slice(0, 4)}****${apiKey.slice(-4)}`;
+}
+
+function sanitizeProviderPayload(payload: unknown) {
+  if (!payload || typeof payload !== "object") return payload;
+  const cloned = { ...(payload as Record<string, unknown>) };
+  if (typeof cloned.apiKey === "string") {
+    cloned.apiKey = maskApiKey(cloned.apiKey);
+  }
+  return cloned;
+}
+
 export async function GET(request: Request) {
   try {
     await requireAdmin();
@@ -68,7 +83,7 @@ export async function POST(request: Request) {
     const session = await requireAdmin();
 
     const body = await request.json();
-    console.log("[Admin API] Create provider request body:", JSON.stringify(body));
+    console.log("[Admin API] Create provider request body:", JSON.stringify(sanitizeProviderPayload(body)));
     
     const data = createProviderSchema.parse(body);
     console.log("[Admin API] Validation passed, creating provider...");