How do I hide an API key in a screenshot?

Cover the entire secret with a solid box or a heavy blur before the screenshot leaves your machine. A prefix such as sk_live_ is fine to show; the characters after it are the secret. Demo with test keys where you can.

I posted a screenshot with an API key in it. What now?

Rotate or revoke the key at the provider first, then check its logs for unfamiliar use, then delete the post. Deleting the post alone does not help: screenshots are cached, reposted and archived.

Is blurring an API key safe?

A heavy blur or a solid box is. Keys are long and random, so a strong blur leaves nothing to guess, but a light blur or small-block pixelation over a monospaced font can sometimes be reversed.

Where do API keys usually leak in screenshots?

Terminal output (env, curl with an Authorization header, shell history), browser devtools request headers and URLs with tokens, dashboards where a key was revealed, config files in diffs and CI logs.

How to hide API keys in screenshots

Q: Can Snapdraft detect API keys automatically?

Yes. On the iPhone, without uploading anything, it detects Stripe keys, AWS access key IDs, sk- style keys such as OpenAI's and Anthropic's, JSON Web Tokens and long card-like numbers, and blurs them. It relies on reading the text, so check the preview.

Updated 25 September 2026

Cover the whole key before the screenshot leaves your machine — and if it already has, rotate the key. Blurring a screenshot you already posted does not un-leak it: posts are cached, quoted and archived within minutes.

The short version

Already posted a screenshot with a live key in it? Rotate the key now. Then clean up the post.
Before posting, look for keys in the places below — most leaks are not the key you were thinking about.
Cover the entire secret, not just the middle. A prefix like sk_live_ is fine to show; the characters after it are the secret.
Use a solid box or a heavy blur. Keys are long and random, so a strong blur leaves nothing to guess — but a light one over a monospaced font is the easiest case there is for recovery.
Demo with test keys. Stripe's sk_test_ keys, a throwaway AWS user, a revoked token: then a slip costs nothing.

Where keys hide in a screenshot

Terminal: env or printenv output, a curl -H "Authorization: Bearer …" line, shell history, a .env file open beside the code.
Browser devtools: the Network tab's request headers and cookies, and URLs with ?token= or ?key= in them.
Dashboards: a key you revealed to copy and never hid again; webhook signing secrets; connection strings with a password in them.
Editors and diffs: a config file in a git diff, a CI log, a Docker compose file.
The edges of the screen: a notification banner with a one-time code, a browser tab title, an email address in the account menu.

If a key already leaked

Rotate or revoke it at the provider first — Stripe, AWS, OpenAI, GitHub and Slack all let you roll or delete a key from the dashboard. Deleting the post comes second.
Check the provider's logs for use you do not recognise between the post and the rotation.
Assume the screenshot is permanent. Replies, reposts and archives keep the original even after you delete yours.

Doing it with iPhone's Markup

For one key in one screenshot, Markup's filled shape is enough and it is free: the steps are in how to blur something in a screenshot on iPhone. Never use the highlighter — it is translucent.

What Snapdraft catches

Snapdraft reads the screenshot on your iPhone and blurs what looks like a secret before you see it: Stripe keys (sk_, pk_ and rk_, live and test), AWS access key IDs, sk- style keys such as OpenAI's and Anthropic's, JSON Web Tokens, and long card- or account-like numbers — along with emails, phone numbers, names and faces. Nothing is uploaded.

Coming in 1.5: GitHub, Slack and Google API tokens, private-key headers and Authorization: Bearer lines.

It depends on reading the text, so a key in tiny or already blurry type can be missed — check the preview, and drag across anything it did not catch. Snapdraft is free; one optional purchase removes a small watermark.