How to Redact Bearer Tokens and API Keys from Postman Collection v2.1 JSON Exports in Local Browser RAM

说明与用途

该工具在浏览器内存中删除Postman导出文件中的令牌，保持JSON结构完整。

问题

Raw Postman collection exports contain live production credentials that must be removed before sharing or uploading to third‑party tools.

结果

Credentials are removed while maintaining JSON schema integrity, enabling safe sharing and import into API clients without cloud upload.

工作流

• Identify credential locations in the JSON (auth objects, headers, variables, scripts).
• Open the Postman Collection Token Redactor in a local browser.
• Select a redaction depth (35% partial, 70% standard, 95% strict).
• Upload the .postman_collection.json file to the tool.
• The tool processes the file entirely in browser RAM and outputs a sanitized JSON.
• Download the sanitized file and import it into Postman or other clients.

证据

Raw Postman exports routinely contain live production Authorization: Bearer JWTs, x-api-key headers, OAuth2 client_secret fields, and inline pm.environment.set() credentials.

来源

Running a naive regex replacement across a 5MB .postman_collection.json often corrupts escaped quotes inside event[].script.exec or strips required schema keys.

来源

We built Postman Collection Token Redactor to solve this directly inside local browser memory.

来源