How to Redact Bearer Tokens and API Keys from Postman Collection v2.1 JSON Exports in Local Browser RAM

Description and use

The tool removes tokens from a Postman collection export while preserving JSON schema, operating entirely in browser RAM.

Problem

Raw Postman collection exports contain live production credentials that must be removed before sharing or uploading to third‑party tools.

Outcome

Credentials are removed while maintaining JSON schema integrity, enabling safe sharing and import into API clients without cloud upload.

Workflow

• Identify credential locations in the JSON (auth objects, headers, variables, scripts).
• Open the Postman Collection Token Redactor in a local browser.
• Select a redaction depth (35% partial, 70% standard, 95% strict).
• Upload the .postman_collection.json file to the tool.
• The tool processes the file entirely in browser RAM and outputs a sanitized JSON.
• Download the sanitized file and import it into Postman or other clients.

Evidence

Raw Postman exports routinely contain live production Authorization: Bearer JWTs, x-api-key headers, OAuth2 client_secret fields, and inline pm.environment.set() credentials.

Source

Running a naive regex replacement across a 5MB .postman_collection.json often corrupts escaped quotes inside event[].script.exec or strips required schema keys.

Source

We built Postman Collection Token Redactor to solve this directly inside local browser memory.

Source