Redaction

Captured traffic is full of credentials: session cookies, bearer tokens, API keys, and passwords in login requests. Redact secrets replaces them with the word REDACTED in the copy you export or publish, so you can share a HAR file, a session or a Gist without handing over your accounts. The traffic in Cloak Proxy itself is never changed.

Turn on redaction

Where	How	Default
Export and save panels	Turn on Redact secrets: tokens, cookies, passwords, API keys and card numbers at the bottom of the panel. Applies to File › Export, File › Save Session…, Export Request in the right-click menu, and Export OpenAPI… in Insights.	Off the first time, then remembers your last choice
Publish to GitHub Gist	Leave Redact secrets on in the sheet.	On every time the sheet opens
cloakctl run	Add --redact to redact the --record file.	Off
MCP export_session	Pass "redact": true.	Off

See Export, Publish to Gist and Headless and CI.

What gets redacted

Credential headers

These request and response headers have their whole value replaced:

Authorization, Proxy-Authorization, X-Api-Key, Api-Key, ApiKey, X-Auth-Token, X-Access-Token, X-CSRF-Token, X-XSRF-Token, X-Amz-Security-Token, X-Goog-Api-Key, X-Session-Token, X-Refresh-Token.

Header names are matched without regard to case. When the value starts with a short scheme word followed by a space, the scheme is kept so the export still shows how authentication works:

Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhZGEifQ.c2lnbmF0dXJl
Authorization: Bearer REDACTED

Cookies

Header	What happens	Example result
Cookie	Every cookie keeps its name and loses its value.	Cookie: session_id=REDACTED; theme=REDACTED
Set-Cookie	The value is replaced; the name and attributes are kept.	Set-Cookie: session_id=REDACTED; Path=/; Secure; HttpOnly

Query parameters

In the URL, a query parameter whose name is a credential name has its value replaced, such as ?api_key=REDACTED. The other parameters and the path are kept, apart from any values matching the secret patterns below.

Request and response bodies

1. Compressed bodies (gzip, deflate, Brotli) are decoded first.
2. In a JSON body, every field whose key is a credential name, or contains password, has its value replaced with "REDACTED". This applies at any depth, to strings, numbers and booleans. When the value is an object or array, Cloak Proxy looks inside it instead, and null is kept.
3. In a form-encoded body (application/x-www-form-urlencoded), every field with a credential name has its value replaced.
4. In every text body, including the JSON and form bodies, values matching the secret patterns below are replaced.

Before

{
  "user": "ada@example.com",
  "password": "hunter2",
  "client_secret": "cs_live_xxxx"
}

After

{"user":"ada@example.com","password":"REDACTED","client_secret":"REDACTED"}

When a body changes, it’s saved decoded: Content-Encoding is removed and Content-Length is updated to the new size (unless the message uses Transfer-Encoding). A redacted JSON body is written compactly, without its original indentation. Bodies that redaction doesn’t change are left exactly as they were.

WebSocket messages

Text messages are checked for the secret patterns below, and matches are replaced. Session files are the only format that includes WebSocket messages.

Credential names

Query parameters, JSON keys and form fields are treated as credentials when their whole name is one of these, in any case:

pass, password, passwd, pwd, secret, client_secret, api_key, api-key, apikey, access_token, access-token, accesstoken, auth_token, auth-token, authtoken, refresh_token, refresh-token, refreshtoken, id_token, token, session_id, session-id, sessionid, private_key, private-key, privatekey, ssn, cvv, cvc.

JSON keys that contain password anywhere, like newPassword or password_confirm, are redacted too.

Secret patterns

Anywhere in headers, URLs, text bodies and WebSocket messages, values with these shapes are replaced. They’re the same patterns the Secrets tab detects:

Pattern	Looks like
AWS access key	AKIA… or ASIA… plus 16 characters
GitHub token	ghp_, gho_, ghu_, ghs_, ghr_ or github_pat_ tokens
Stripe secret key	sk_live_… or rk_live_…
Slack token	xoxa-, xoxb-, xoxp-, xoxr- or xoxs- tokens
Anthropic API key	sk-ant-…
OpenAI API key	sk-… or sk-proj-…
Private key	A PEM -----BEGIN … PRIVATE KEY----- line
Google API key	AIza… plus 35 characters
JSON Web Token	eyJ….eyJ….…
Card number	A Luhn-valid card number

What isn’t redacted

Redaction targets credentials. It keeps everything else so the export is still useful:

• Host names, paths, IP addresses and the client app’s name.
• Personal data in fields that aren’t credential names: names, email addresses, phone numbers, addresses, user IDs.
• Headers not in the list above, unless their value matches a secret pattern. A custom header like X-My-Signature keeps its value.
• Keys in formats the patterns don’t cover, including Stripe test keys (sk_test_…).
• Binary bodies and bodies that aren’t UTF-8 text, such as images, Protobuf and MessagePack.

Check before you share

Redaction is pattern-based. It can’t know that a field called x holds a password. Before you share a redacted file, open it and look, or import it back into Cloak Proxy and check the Secrets tab: values already replaced with REDACTED aren’t reported, so anything listed there slipped through.

Check a redacted export

1. Export with Redact secrets on.
2. Save the unredacted session first if you still need it, then press ⌘ K to clear the traffic list so only the file’s requests are analyzed.
3. Open the exported file with File › Open Session… (⌘ O).
4. Open Insights with ⌥ ⌘ I and check the Secrets tab. It should list nothing you care about.
5. Spot-check a few requests in the inspector for personal data the scanner doesn’t look for.

Related

SecretsFind leaked keys and tokens in captured traffic.

ExportEvery export format and what it contains.

Publish to GistShare redacted traffic on GitHub.

Security and privacyWhat stays on your Mac and how to protect it.