Currently, if you enable GOOGLE_SDK_NODE_LOGGING to get extra logging, both the instance request and the instance metadata are logged.

Unfortunately, the latter includes an access_token in it, which is rather dangerous to log.

I can imagine two solutions:

• Remove the access_token from the log, and maybe introduce another env var like INCLUDE_ACCESS_TOKEN_IN_LOG if someone really wants it
• Split the logger into two subloggers (request/response?) which would allow the user to configure which one they want with GOOGLE_SDK_NODE_LOGGING https://github.com/googleapis/gax-nodejs/tree/main/logging-utils#logging