diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 10f3091..b06ba91 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.2.0"
+  ".": "0.2.1"
 }
\ No newline at end of file
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 21f8a2a..7539a97 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.2.1 (2026-05-08)
+
+Full Changelog: [v0.2.0...v0.2.1](https://github.com/matrices/cerca-cli/compare/v0.2.0...v0.2.1)
+
+### Chores
+
+* redact api-key headers in debug logs ([e64047f](https://github.com/matrices/cerca-cli/commit/e64047f3895aee6c901a0e949410de72fc62484b))
+* **test:** scope body requests to a single variant ([ae7d57b](https://github.com/matrices/cerca-cli/commit/ae7d57bf224a53df2f7231b806361c4ba86033a2))
+
 ## 0.2.0 (2026-05-07)
 
 Full Changelog: [v0.1.0...v0.2.0](https://github.com/matrices/cerca-cli/compare/v0.1.0...v0.2.0)
diff --git a/internal/debugmiddleware/debug_middleware.go b/internal/debugmiddleware/debug_middleware.go
index f07b93b..647f1de 100644
--- a/internal/debugmiddleware/debug_middleware.go
+++ b/internal/debugmiddleware/debug_middleware.go
@@ -21,7 +21,12 @@ const redactedPlaceholder = "<REDACTED>"
 
 // Headers known to contain sensitive information like an API key. Note that this exclude `Authorization`,
 // which is handled specially in `redactRequest` below.
-var sensitiveHeaders = []string{}
+var sensitiveHeaders = []string{
+	"api-key",
+	"x-api-key",
+	"cookie",
+	"set-cookie",
+}
 
 // RequestLogger is a middleware that logs HTTP requests and responses.
 type RequestLogger struct {
diff --git a/pkg/cmd/tool.go b/pkg/cmd/tool.go
index 7145d93..a3376b3 100644
--- a/pkg/cmd/tool.go
+++ b/pkg/cmd/tool.go
@@ -37,7 +37,6 @@ var toolsCreate = requestflag.WithInnerFlags(cli.Command{
 		},
 		&requestflag.Flag[[]map[string]any]{
 			Name:     "tool",
-			Required: true,
 			BodyPath: "tools",
 		},
 		&requestflag.Flag[string]{
@@ -63,7 +62,6 @@ var toolsCreate = requestflag.WithInnerFlags(cli.Command{
 		},
 		&requestflag.Flag[string]{
 			Name:     "url",
-			Required: true,
 			BodyPath: "url",
 		},
 	},
@@ -174,7 +172,6 @@ var toolsUpdate = requestflag.WithInnerFlags(cli.Command{
 		},
 		&requestflag.Flag[[]map[string]any]{
 			Name:     "tool",
-			Required: true,
 			BodyPath: "tools",
 		},
 		&requestflag.Flag[string]{
@@ -200,7 +197,6 @@ var toolsUpdate = requestflag.WithInnerFlags(cli.Command{
 		},
 		&requestflag.Flag[string]{
 			Name:     "url",
-			Required: true,
 			BodyPath: "url",
 		},
 	},
diff --git a/pkg/cmd/tool_test.go b/pkg/cmd/tool_test.go
index d811081..91e3dbc 100644
--- a/pkg/cmd/tool_test.go
+++ b/pkg/cmd/tool_test.go
@@ -23,7 +23,6 @@ func TestToolsCreate(t *testing.T) {
 			"--approval", "always",
 			"--enabled=true",
 			"--execution", "{idempotencyKeyHeader: idempotencyKeyHeader, maxAttempts: 3, retryMode: safe_only, timeoutMs: 10000}",
-			"--url", "https://mcp.example.com",
 		)
 	})
 
@@ -53,7 +52,6 @@ func TestToolsCreate(t *testing.T) {
 			"--execution.max-attempts", "3",
 			"--execution.retry-mode", "safe_only",
 			"--execution.timeout-ms", "10000",
-			"--url", "https://mcp.example.com",
 		)
 	})
 
@@ -93,8 +91,7 @@ func TestToolsCreate(t *testing.T) {
 			"  idempotencyKeyHeader: idempotencyKeyHeader\n" +
 			"  maxAttempts: 3\n" +
 			"  retryMode: safe_only\n" +
-			"  timeoutMs: 10000\n" +
-			"url: https://mcp.example.com\n")
+			"  timeoutMs: 10000\n")
 		mocktest.TestRunMockTestWithPipeAndFlags(
 			t, pipeData,
 			"--api-key", "string",
@@ -131,7 +128,6 @@ func TestToolsUpdate(t *testing.T) {
 			"--approval", "always",
 			"--enabled=true",
 			"--execution", "{idempotencyKeyHeader: idempotencyKeyHeader, maxAttempts: 3, retryMode: safe_only, timeoutMs: 10000}",
-			"--url", "https://mcp.example.com",
 		)
 	})
 
@@ -162,7 +158,6 @@ func TestToolsUpdate(t *testing.T) {
 			"--execution.max-attempts", "3",
 			"--execution.retry-mode", "safe_only",
 			"--execution.timeout-ms", "10000",
-			"--url", "https://mcp.example.com",
 		)
 	})
 
@@ -202,8 +197,7 @@ func TestToolsUpdate(t *testing.T) {
 			"  idempotencyKeyHeader: idempotencyKeyHeader\n" +
 			"  maxAttempts: 3\n" +
 			"  retryMode: safe_only\n" +
-			"  timeoutMs: 10000\n" +
-			"url: https://mcp.example.com\n")
+			"  timeoutMs: 10000\n")
 		mocktest.TestRunMockTestWithPipeAndFlags(
 			t, pipeData,
 			"--api-key", "string",
diff --git a/pkg/cmd/version.go b/pkg/cmd/version.go
index 10d2893..d5ec181 100644
--- a/pkg/cmd/version.go
+++ b/pkg/cmd/version.go
@@ -2,4 +2,4 @@
 
 package cmd
 
-const Version = "0.2.0" // x-release-please-version
+const Version = "0.2.1" // x-release-please-version