diff --git a/fern/server-url/server-authentication.mdx b/fern/server-url/server-authentication.mdx
index 32c4edf16..dbb9e9afa 100644
--- a/fern/server-url/server-authentication.mdx
+++ b/fern/server-url/server-authentication.mdx
@@ -407,14 +407,15 @@ For webhooks sent to a server URL supplied in the API request, Vapi also strips
 
 #### Confirming a withheld send in your logs
 
-When Vapi withholds credentials, it also writes an entry to the call's webhook logs:
+When Vapi withholds credentials, it also writes an entry to the call's logs:
 
 ```text
-Assistant credentials withheld from <messageType>: this server url came from an
-assistant this request supplied, not from your org configuration
+Assistant credentials withheld from <messageType>: this server url came from an assistant this request supplied, not from your org configuration
 ```
 
-The entry is written **once per message type, not once per send**. Vapi suppresses it for high-volume message types: `model-output`, `speech-update`, `status-update`, `transcript`, `transcript[transcriptType="final"]`, `voice-input`, and `voice-request`.
+To find it, search the call's logs for the text `credentials withheld`. Don't rely on the log category filter: the entry is not always filed under the webhook category.
+
+Vapi writes the entry **on each send** of a message type that is not suppressed, so the same entry can repeat within a call. Vapi suppresses it for high-volume message types: `model-output`, `speech-update`, `status-update`, `transcript`, `transcript[transcriptType="final"]`, `voice-input`, and `voice-request`.
 
 <Warning>
 A missing log entry on a suppressed type does **not** mean credentials were sent. Credential withholding always happens on this path; only the log entry is suppressed. Check `end-of-call-report`, `call.artifact.upload`, or the session and chat webhooks. At least one of these is logged on every affected call.