Credentials and secrets

Redact API keys from text, JSON, and CSV

The most common security incident in developer tooling is a key pasted into a ticket, a commit message, or an LLM prompt. Redactly recognises the prefixes used by major providers and redacts the whole key.

Try it on the live API No signup. 2,000 characters, 20 runs per 10 minutes.

Output appears here.

How Redactly detects API keys

Matched by regex against known key prefixes: AKIA for AWS, sk- and sk-ant- for OpenAI and Anthropic, ghp_ for GitHub, AIza for Google, xox for Slack, and hf_ for Hugging Face.
Runs independently of the model so a key inside a config dump is caught without context.
The full key is the span, including the prefix, so no usable fragment survives.

Why redact API keys?

A leaked key is an immediate, unattended compromise: it does not need a person to click anything.

Example request

curl -X POST https://api.bitbanger.in/v1/redact \
  -H "X-API-Key: rdct_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"text": "Config: OPENAI_API_KEY=sk-proj-AbCdEf1234567890AbCdEf1234567890", "style": "replace"}'

Every hit in the response carries entity, text, start, and end. The offsets index into the text you sent, so you can apply the redactions to your own copy of the document. The full response schema is in the API reference.

Questions

Does Redactly redact API keys automatically?

Yes. Send text to the API and every detected type is redacted, including API keys. To redact only this type, pass the value credential.api_key in the entities filter. No training or configuration is required.

What happens to API keys after redaction?

With style set to replace, each match becomes [credential.api_key] — the entity type in square brackets. Setting style to mask replaces every character with a block character, and remove deletes the span entirely.

Related entity types

Redact API keys in production

Get an API key and send your first request in a minute. Plans start at $24/month.

See pricing