How to Redact an API Key or Token From a Screenshot

It happens fast. You screenshot your terminal to show a teammate an error, or paste a dashboard into a ticket, and a live API key or token is sitting right there in the frame. Here is what to do, in order, whether the key has already left your machine or you caught it just in time.

First, if the key is already shared: rotate it

If the screenshot with the key has already gone into Slack, a ticket, an email, or anywhere else, redaction is no longer the priority. Assume the key is compromised and rotate it. Revoke the exposed key or token in the provider's dashboard and issue a new one. A black box drawn after the fact does nothing about the copy that already left. Rotate first, redact the image second.

This is the honest order of operations, and it is the part most rushed guides skip. Covering the pixels does not un-send the secret.

Manually redacting a key before you share

If you caught it before sending, cover it properly:

1. Open the screenshot in Preview.
2. Click Markup, then Shapes, and choose the rectangle.
3. Draw it over the entire key, including the prefix and any trailing characters.
4. Set the fill to solid black. A hollow box hides nothing.
5. Export to a flat PNG so the cover is baked into the pixels.

Why a solid box beats cropping or blurring a terminal

Cropping is risky in a terminal screenshot because scrollback and wrapped lines can still expose part of the key elsewhere in the frame. Blurring is risky because it only rearranges the pixels rather than removing them. A solid, opaque box, flattened on export, is the move. Cover the whole token, not just the middle.

What manual redaction misses

Secrets hide in places you are not looking. A few of the usual suspects in a terminal screenshot:

• Scrollback. The key you covered on the visible line may also appear a few lines up, or in a previous command you re-ran.
• Environment output. A stray env or printenv dump can expose a dozen secrets at once, several of which you were not thinking about.
• Config paths and hostnames. Not a secret by themselves, but useful to an attacker who already has the key.
• The window chrome. A tab title, a Slack notification, or a bookmark bar caught in the same frame.

The core weakness of doing this by hand is that you only redact what you notice, on the day you happen to be paying attention.

Prevention beyond the screenshot

Screenshot redaction is one layer, and it is worth pairing with the basics that keep secrets out of your captures in the first place: store keys in environment variables or a secrets manager rather than hard-coding them, avoid printing them to your terminal, and keep them out of version control. Those habits reduce how often a live key is ever on screen to be captured at all. Screenshot redaction then catches the times it slips through anyway.

Catching keys before they leave your machine

The durable fix is prevention that does not depend on you spotting the key. Whiteout reads each screenshot with Apple's on-device text recognition and checks it against tuned patterns for eleven kinds of sensitive data, including API keys and tokens, then covers what it finds with a solid black box automatically, before you attach the image anywhere.

It is not a replacement for looking, and it will not catch a key in an unusual format or a low-quality capture, which is exactly why it flags what it finds for review. But for the everyday case of a token sitting in plain text in your terminal, having it covered automatically means one distracted screenshot no longer turns into an incident.

And if a key does slip out: rotate it, then move on. It is the cheapest recovery you will ever make.