fastapi-redaction 0.1.0

Redact secrets in FastAPI requests, responses, and logs.

📦 fastapi-redaction

Automatic secret & sensitive-data redaction for FastAPI (logs, headers, responses)
Prevent AWS keys, Okta tokens, DB passwords, SFTP credentials, SharePoint secrets, JWT secrets, and any sensitive values from leaking into logs or API responses — without modifying your FastAPI endpoint code.

---

---

🚨 Why this package exists

FastAPI applications often log or return sensitive information during:

• 🐞 Debugging
• ⚠️ Exception handling
• 🔄 Background tasks
• 📜 Request logging
• 🛡 Middleware traces
• 📤 API responses

This can unintentionally expose:

• 🔑 AWS access keys
• 🔐 Okta API tokens
• 🔑 SFTP / SSH passwords
• 📂 SharePoint / MS Graph secrets
• 🗄 Database passwords
• 🔒 JWT secrets & signing keys
• 🌍 Third-party API keys

👉 This library fully prevents such leaks by automatically redacting secrets at multiple layers.

---

✨ Features

• 🔥 Full-stack secret masking
  Redacts secrets from JSON responses, headers, logs, and any string containing sensitive substrings.

• 🔍 Automatic secret discovery
  Detects environment variables like *_SECRET, *_KEY, *_TOKEN, *_PASSWORD, CREDENTIAL, PRIVATE_KEY.

• 🧠 Substring-based masking
  Any secret value is replaced with: REDACTED.

• 🛡 Configurable JSON key masking
  Force-hide fields such as: password, token, secret, api_key, session.

• 💨 Zero changes to your API endpoints
  Just one line:

  redaction.init_app(app)
  

📥 Installation

 pip install fastapi-redaction

🚀 Quick Start Example

 python -m build   

 pip install dist/fastapi_redaction-0.1.0-py3-none-any.whl    

 python .\example_app.py   

⚙️ Advanced Usage

🔧 Explicit environment variables

  config = RedactionConfig(
      explicit_env_keys=[
          "SFTP_PASSWORD",
          "SHAREPOINT_CLIENT_SECRET",
          "MY_SERVICE_TOKEN",
      ]
  )

🔐 Security Notes

This package prevents secret leakage to:

• 🌐 API clients
• 🖥 Browser DevTools
• ☁️ Cloud logs
• 🔄 Reverse proxies
• 🤖 AI tools in IDEs (Copilot, Cursor, Windsurf)
• 💻 Local console output

⚠️ It does not modify your internal logic — handlers still receive the real values.