From 454318469bb4e5067f08a816a5c9e0a74e836cec Mon Sep 17 00:00:00 2001
From: Franck Nijhof <git@frenck.dev>
Date: Wed, 16 Sep 2026 07:21:44 +0200
Subject: [PATCH] Do not log the Start.ca API key (#182279)

---
 homeassistant/components/startca/sensor.py |  2 +-
 tests/components/startca/test_sensor.py    | 26 ++++++++++++++++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/homeassistant/components/startca/sensor.py b/homeassistant/components/startca/sensor.py
index afab0e2203ab..bf11dc84b50a 100644
--- a/homeassistant/components/startca/sensor.py
+++ b/homeassistant/components/startca/sensor.py
@@ -152,7 +152,7 @@ async def async_setup_platform(
     ts_data = StartcaData(websession, apikey, bandwidthcap)
     ret = await ts_data.async_update()
     if ret is False:
-        _LOGGER.error("Invalid Start.ca API key: %s", apikey)
+        _LOGGER.error("Invalid Start.ca API key")
         return
 
     name = config[CONF_NAME]
diff --git a/tests/components/startca/test_sensor.py b/tests/components/startca/test_sensor.py
index ef7b704a7188..6630e9b03e19 100644
--- a/tests/components/startca/test_sensor.py
+++ b/tests/components/startca/test_sensor.py
@@ -2,6 +2,8 @@
 
 from http import HTTPStatus
 
+import pytest
+
 from homeassistant.components.startca.sensor import StartcaData
 from homeassistant.const import ATTR_UNIT_OF_MEASUREMENT, PERCENTAGE, UnitOfInformation
 from homeassistant.core import HomeAssistant
@@ -227,3 +229,27 @@ async def test_bad_json_decode(
 
     result = await scd.async_update()
     assert result is False
+
+
+async def test_invalid_api_key(
+    hass: HomeAssistant,
+    aioclient_mock: AiohttpClientMocker,
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    """Test that setup stops when Start.ca rejects the key."""
+    config = {
+        "platform": "startca",
+        "api_key": "NOTAKEY",
+        "total_bandwidth": 400,
+        "monitored_variables": ["usage"],
+    }
+    aioclient_mock.get(
+        "https://www.start.ca/support/usage/api?key=NOTAKEY",
+        status=HTTPStatus.NOT_FOUND,
+    )
+
+    await async_setup_component(hass, "sensor", {"sensor": config})
+    await hass.async_block_till_done()
+
+    assert hass.states.get("sensor.start_ca_usage") is None
+    assert "Invalid Start.ca API key" in caplog.text