HubSpot's OAuth token introspection endpoint places the access token in the URL path, leaking it through error messages

GET https://api.hubapi.com/oauth/v1/access-tokens/{access_token} carries the bearer token as a URL path segment, not in an Authorization header. Standard HTTP error handling (e.g. httpx.HTTPStatusError.__str__, transport-error messages) typically embeds the request URL, which means the access token leaks into tracebacks, log lines, and any caller printing the exception's str() form. Calling raise NewError(...) from None (dropping the cause chain) is required to prevent token disclosure.

When wrapping HTTP errors from APIs that put credentials in URL paths or query parameters, always strip the request URL from error messages and use raise NewError(...) from None to drop the captured cause's string form.