CDAHttpException uses setLogSensitiveData field only in "headersToString()" but okhttpclient is logging the request including headers. Do the Bearer Token in the headers is still logged in the request part.
private String createString() {
return format(
Locale.getDefault(),
"FAILED REQUEST:\n\t%s\n\t╰→ Header{%s}\n\t%s\n\t├→ Body{%s}\n\t╰→ Header{%s}",
request.toString(), //headers included
headersToString(request.headers()), //headers omitted when setLogSensitiveData(false)
response.toString(),
responseBody,
headersToString(response.headers()));
}