---
url: https://aelmanaa.github.io/hardhat-kms/user/guides/debug-output.md
description: >-
  Turn on hardhat-kms debug output with DEBUG=hardhat:kms:*, what each namespace
  logs, and what to check before you share it in an issue.
---

# Debug output

Set `DEBUG` to turn on the plugin's debug output. It goes to standard error:

```sh
DEBUG=hardhat:kms:* npx hardhat run scripts/deploy.ts --network sepolia
```

`DEBUG=hardhat:*` also turns on Hardhat's own debug output. `DEBUG` takes a comma-separated list, so `DEBUG=hardhat:kms:config,hardhat:kms:signer` shows just those two namespaces. Set `DEBUG_COLORS=no` for plain text.

> \[!NOTE]
> Audience: users who want to see what the plugin does, for example when a key is slow or fails.

## Namespaces

| Namespace               | What it logs                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hardhat:kms:config`    | The display ids of the resolved keys, and of the keys each network uses.                                                                                                                                                                                                                                                                                                                                                                                                                          |
| `hardhat:kms:providers` | Each key whose adapter is being created, and `<display id>: no plugin claimed the key` when no provider plugin handles it, for example because `@hardhat-kms/aws` is not in `plugins`. Also `<display id>: creating the adapter failed (<error class>)`.                                                                                                                                                                                                                                          |
| `hardhat:kms:signer`    | Each call to a key's adapter with its operation, request id, duration and, on failure, error class name. Also the derived address, retries, and the number of signers closed when the last connection has been idle for 5 s.                                                                                                                                                                                                                                                                      |
| `hardhat:kms:rpc`       | Each connection to a network with KMS keys, with the network name and the number of keys; the display ids of the keys once their addresses are resolved; an `eth_accounts` or `eth_requestAccounts` call that failed downstream, with the error's class name, after which only the KMS addresses are listed; a nonce given to a library account's send, which then holds the lock, or reserved for one with its own transport; and a raw transaction passed on without the lock, with the reason. |
| `hardhat:kms:account`   | Each library account made with `connection.kms.getAccount`, with its address and network, and each transaction or authorization it signs, with its type and chain.                                                                                                                                                                                                                                                                                                                                |
| `hardhat:kms:history`   | Each `kms history` read, with the key's display id; a read that failed, with the error's class name; a reader that did not return in time; and a key whose provider has no history reader.                                                                                                                                                                                                                                                                                                        |
| `hardhat:kms:azure`     | The name of `AZURE_USERNAME` or `AZURE_PASSWORD` when the Azure credential chain ignores it, never its value.                                                                                                                                                                                                                                                                                                                                                                                     |

`hardhat:kms:providers` and `hardhat:kms:signer` print nothing until a connection first uses a key, to look up its address or to sign.

## What the output contains

Review the output before you share it, for example in an issue. It contains display ids (`aws:<AWS_KMS_KEY_ID>`), addresses, provider ids, operation names, request ids, timings and error class names. Key and network names from your config are printed as written, with control characters escaped. So is a key identifier written literally in the config, such as a key ARN, which holds your AWS account id ([Resolved config](https://aelmanaa.github.io/hardhat-kms/user/reference/configuration.md#resolved-config)). Configuration-variable values are hidden.

It never contains:

* the values of configuration variables, such as key ids or RPC URLs read from your environment;
* credentials, tokens or anything else in a third-party provider's key config;
* a provider's error messages, which can carry request details. Only the error class name is shown, such as `TypeError`.

A test runs the plugin with `DEBUG=hardhat:kms:*` and secrets planted in configuration variables and in a provider's error message, and fails if any secret appears in the output.