Publish to Gist

Publish to GitHub Gist uploads selected requests to a gist on your GitHub account and copies the link, so you can share a reproduction in an issue, a pull request or a chat without attaching files. You choose the format (HAR, cURL commands or a Postman collection), and secrets are redacted before upload unless you turn that off.

12345

Redaction is on and the gist is secret by default.

1. Format: HAR, cURL commands or Postman Collection
2. Redact secrets before upload
3. Public gist: off means a secret gist
4. Your GitHub token with the gist scope
5. Create a token on GitHub…

×

Before you start

You need a GitHub personal access token that can create gists:

• Classic token: click Create a token on GitHub… in the sheet. It opens GitHub’s new classic token page with the gist scope already selected. Give it an expiration and generate it. The token starts with ghp_.
• Fine-grained token: create one on GitHub with the Gists account permission set to read and write. It starts with github_pat_.

Give the token only the gist permission. It doesn’t need access to your repositories.

Publish requests

1. In the traffic list, select the requests to share.
2. Right-click them and choose Publish to GitHub Gist…. The sheet’s title shows how many requests will be published. If you right-click a row outside the selection, only that row is published.
3. Pick a Format.
4. Leave Redact secrets on unless you’re sure the requests hold nothing private.
5. Edit the Description. It defaults to “Cloak Proxy capture” and appears on the gist page.
6. Leave Public gist off for a secret gist, or turn it on to list it publicly.
7. Paste your token into GitHub token (gist scope). If you saved one before, it’s already filled in.
8. Click Publish. The button says Publishing… while it uploads.

When it’s done, the sheet shows Published and copied to the clipboard with the gist’s link. Click the link to open it, or click Done to close the sheet. Publish is disabled until a token is entered.

Options

Option	What it does	Default
Format	HAR uploads cloak-proxy.har. cURL commands uploads requests.sh, one curl command per request separated by blank lines (undecrypted tunnels are skipped). Postman Collection uploads cloak-proxy.postman_collection.json.	HAR
Redact secrets	Replaces tokens, cookies, passwords, API keys and card numbers with REDACTED before upload. See Redaction.	On, every time the sheet opens
Description	The gist’s description.	Cloak Proxy capture
Public gist	Off creates a secret gist; on creates a public one.	Off
GitHub token (gist scope)	The token used to create the gist. Shown as dots.	Your saved token, if any
Remember token in Keychain	On saves the token after a successful publish. Off deletes any saved token after a successful publish.	On

The formats match the export formats. See Export for what HAR and Postman files contain.

Redaction in the sheet

With Redact secrets on, the sheet shows a green note: “Tokens, cookies, passwords, API keys and card numbers are replaced with REDACTED before upload.”

With it off, the note turns orange and warns that captured headers often include cookies and tokens. If the secret scanner found anything in the requests you’re publishing, the warning also says how many possible secrets it found, and reminds you that a secret gist is still readable by anyone with the link.

Secret gists aren't private

A secret gist is only hidden from search and your public profile. Anyone who has the link can read it, and links get forwarded, pasted into tickets and indexed by tools. Keep Redact secrets on, publish only traffic you’re allowed to share, and delete the gist on GitHub when it’s no longer needed.

Where the token is stored

When Remember token in Keychain is on, Cloak Proxy saves the token in your login keychain as a password item labeled Cloak Proxy GitHub token (service com.subcloak.cloakproxy.github). It’s only saved after a publish succeeds, and it’s filled in automatically the next time you open the sheet.

To remove it, turn off Remember token in Keychain and publish once, or delete the item in the Keychain Access app.

The token is sent only to api.github.com, over HTTPS, to create the gist. Nothing else in Cloak Proxy uses it.

Protect the token

Anyone with the token can create, edit and delete gists on your account. Use a token with only gist access and an expiration date, and revoke it on GitHub if you think it leaked or you stop using this feature.

If publishing fails

Message	Cause	Fix
GitHub rejected the token. Create one with the “gist” scope.	GitHub answered 401: the token is wrong, expired or revoked.	Create a new token and paste it in.
A message from GitHub	GitHub refused the request, for example because the token lacks gist permission or you hit a rate limit.	Read the message, fix the token or wait, and try again.
GitHub answered followed by a status code	GitHub returned an error without a message.	Try again later.
A network error	Your Mac couldn’t reach api.github.com.	Check your connection.

The sheet stays open after an error, so you can fix the token and click Publish again.

Related

RedactionExactly what gets replaced before upload.

ExportSave HAR, CSV, Postman and OpenAPI files instead.

SecretsCheck traffic for keys and tokens before sharing.

Security and privacyWhat leaves your Mac and when.