A useful error log should explain the failure without copying the customer’s secrets.
Record a correlation ID, operation, outcome and timing. Exclude passwords and access tokens; redact sensitive payload fields before they reach log storage.
Test with a fake secret, trigger a failure, and check the logs—including error paths.
https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html