Data Masking

Webhook payloads can contain sensitive values: customer emails, card details, internal tokens, or provider signature headers. Data masking lets you hide those values in the event viewer so they're not visible to anyone with dashboard access, while body bytes are preserved for delivery. Forwarded headers use the supported provider allowlist; credentials and transport metadata are excluded.

How it works

Masking is applied at the display layer only. The raw event is stored exactly as received and forwarded to destinations unchanged. The only thing that changes is what gets rendered in the event viewer: masked values are replaced with [redacted].

This means you get full webhook delivery fidelity alongside a clean, safe view of events in the dashboard.

Enabling masking for a source

1. Go to Sources in your project.
2. Open the source menu (the three-dot icon on any source row).
3. Select Data masking.
4. Toggle on Mask sensitive headers.
5. Optionally add custom header names or payload field paths (see below).
6. Click Save.

What gets masked

When masking is on for a source, three layers of headers are hidden:

Always masked (global, regardless of provider):

• Authorization
• Cookie and Set-Cookie
• X-Api-Key, X-Auth-Token, X-Access-Token, X-Secret, X-Token
• Proxy-Authorization

Provider signature headers (masked when the source has a known provider set):

• Stripe: Stripe-Signature
• GitHub: X-Hub-Signature-256 and X-Hub-Signature
• Shopify: X-Shopify-Hmac-SHA256

Custom headers (anything you add to the list for that source): Any header name you add is hidden in the same way.

Custom header names

Type a header name into the "Additional headers to hide" field and press Enter or click Add. Header names are case-insensitive. To remove one, click the X on its chip. Changes apply after you save.

Payload field masking

For JSON payloads, you can also redact specific fields by their path. Use dot notation to target nested values:

data.card.number
customer.email
metadata.internal_token

Add paths in the "Payload fields to hide" field. Each path is applied to the parsed JSON body. If the path doesn't exist in a given payload, it's silently skipped. Non-JSON payloads are not affected.

Headers view indicator

When a source has masking on, the event viewer shows a small note at the top of the headers tab confirming that sensitive headers are hidden. This makes it clear that the view is intentionally incomplete, rather than looking like missing data.

What isn't masked

• The raw body stored in the database is never modified
• Delivery to destinations uses the original unmasked body and the supported provider header allowlist
• Replay uses the original data

Masking is about what you see in the dashboard, not what gets delivered.

Turning masking off

Toggle off Mask sensitive headers in the Data masking panel for a source and save. The custom header and field lists are preserved so you can re-enable without reconfiguring.