How to Redact Bearer Tokens and API Keys from Postman Collection v2.1 JSON Exports in Local Browser RAM

Описание и применение

Скрипт удаляет токены из экспорта Postman, сохраняя структуру JSON, и работает полностью в браузере.

Задача

Raw Postman collection exports contain live production credentials that must be removed before sharing or uploading to third‑party tools.

Результат

Credentials are removed while maintaining JSON schema integrity, enabling safe sharing and import into API clients without cloud upload.

Рабочий процесс

• Identify credential locations in the JSON (auth objects, headers, variables, scripts).
• Open the Postman Collection Token Redactor in a local browser.
• Select a redaction depth (35% partial, 70% standard, 95% strict).
• Upload the .postman_collection.json file to the tool.
• The tool processes the file entirely in browser RAM and outputs a sanitized JSON.
• Download the sanitized file and import it into Postman or other clients.

Доказательства

Raw Postman exports routinely contain live production Authorization: Bearer JWTs, x-api-key headers, OAuth2 client_secret fields, and inline pm.environment.set() credentials.

Источник

Running a naive regex replacement across a 5MB .postman_collection.json often corrupts escaped quotes inside event[].script.exec or strips required schema keys.

Источник

We built Postman Collection Token Redactor to solve this directly inside local browser memory.

Источник