diff --git a/packages/db/src/lib/provider-credential-fingerprint.ts b/packages/db/src/lib/provider-credential-fingerprint.ts
index fc37b09a0..a139abc64 100644
--- a/packages/db/src/lib/provider-credential-fingerprint.ts
+++ b/packages/db/src/lib/provider-credential-fingerprint.ts
@@ -2,6 +2,10 @@ import { createHmac } from 'node:crypto';
 
 import { getEncryptionKey } from '@roomote/env';
 
+/**
+ * Returns a stable, non-secret grouping identifier using a deployment-keyed HMAC.
+ * It is not used for authentication or password storage, so password-KDF semantics do not apply.
+ */
 export function fingerprintProviderCredential(apiKey: string): string {
   return createHmac('sha256', getEncryptionKey())
     .update(apiKey)