DEV Community

Xvibelabs
Xvibelabs

Posted on Originally published at xvibelabs.com

How to Redact Bearer Tokens and API Keys from Postman Collection v2.1 JSON Exports in Local Browser RAM

#webdev #privacy #opensource #programming

title: "How to Redact Bearer Tokens and API Keys from Postman Collection v2.1 JSON Exports in Local Browser RAM"
published: true
tags: webdev, security, api, javascript

canonical_url: https://xvibelabs.com/tools/070-postman-collection-token-redactor/

Sharing a .postman_collection.json or .postman_environment.json file to reproduce an API bug with a teammate, external vendor, or CI repository is a daily workflow for backend and QA engineers. Yet raw Postman exports routinely contain live production Authorization: Bearer JWTs, x-api-key headers, OAuth2 client_secret fields, and inline pm.environment.set() credentials.

Where Credentials Hide Inside Postman Collection v2.1 JSON

Unlike flat .env files, a Postman Collection v2.1 export nests credentials across four distinct locations:

  1. Auth Objects (request.auth.bearer / request.auth.apikey): Stored as key-value arrays inside collection, folder, or request nodes.
  2. Request Headers (request.header[]): Plaintext Authorization, x-api-key, and Proxy-Authorization values.
  3. Collection & Environment Variables (variable[] / values[]): Initial and current values exported alongside endpoint definitions.
  4. Pre-Request & Test Scripts (event[].script.exec[]): JavaScript lines setting temporary tokens via pm.environment.set('TOKEN', 'sk_live_...').

Why Manual Regex Editing Breaks Postman Imports

Running a naive regex replacement across a 5MB .postman_collection.json often corrupts escaped quotes inside event[].script.exec or strips required schema keys (_postman_id, schema.getpostman.com/json/collection/v2.1.0/collection.json). Meanwhile, uploading raw collections containing live production tokens to third-party cloud formatters violates SOC2 and ISO-27001 data handling policies.

100% In-Browser RAM Sanitization

We built Postman Collection Token Redactor to solve this directly inside local browser memory:

  • 3-Tier Adjustable Redaction Depth: Toggle between 35% Partial Token Prefix Mask, 70% Standard Collection Redaction ([REDACTED_POSTMAN_TOKEN]), and 95% Strict Safe-Harbor Scrub.
  • Schema-Safe Output: Preserves folder hierarchies, request methods, and variable keys so the sanitized file imports cleanly into Postman, Insomnia, or Bruno.
  • Zero Cloud Upload: Every byte is processed in local browser RAM with zero server egress.

Try the interactive workbench or compare it against cloud secret managers:

👉 Open Postman Collection Token Redactor Live Sandbox

Top comments (0)