When an IDP backend proxy endpoint calls an internal service through a Delegate and a header uses a secret, the target currently receives two requests per click. The first is a connectivity check that carries the unresolved secret expression instead of the secret value, and the second is the real call with the secret resolved. If the target rejects the first request, it shows up as a spurious error in the target's logs, and the secret expression string reaches a service that should never see it.

Please send the connectivity check without the unresolved secret headers. That would keep the expression out of the target's logs, avoid the noisy errors, and let repeated calls to the same target reuse the earlier check instead of sending an extra request each time.