How to Hide API Keys When Recording Your Screen
To hide API keys when recording your screen, remove secrets from the page before recording or blur them in the browser so the recorder never captures the raw key.
Do not rely on editing later. One frame is enough. If the recording exports with a live key visible, you should rotate the key as if it leaked.
names, emails, phones
balances, cards, invoices
keys, tokens, codes
Where API keys leak in recordings
Keys show up in docs, dashboards, terminal windows, environment files, browser devtools, request URLs, logs, and admin consoles. They are easy to miss because you are usually focused on explaining the feature, not scanning every sidebar.
- .env files and setup guides.
- Provider dashboards for Stripe, OpenAI, AWS, GitHub, and similar tools.
- Terminal output and command history.
- Network tabs, logs, and copied curl commands.
Before recording
Use test keys when possible. Close dashboards you do not need. Clear terminal history if the command line will be visible. Prepare a clean browser profile for tutorials so personal accounts and production secrets are not sitting nearby.
Blur at the source
Post-production blur works, but it is slow and fragile. If the page scrolls, the overlay has to follow it. If the secret appears for one frame before the blur starts, the export still contains the leak.
Blurring in the browser means Loom, OBS, Zoom, or any screen recorder captures the blurred version from the start.
If a key was visible
Rotate it. Do not debate whether someone noticed. Revoke the exposed key, create a new one, update your environment, check recent usage, and re-export the recording only after the secret is gone.
Practical examples
Developer recording traps
- A terminal command includes a token in a URL or header while you explain the request.
- A dashboard reveals the first and last characters of a production key, plus the project name.
- A browser network panel shows headers, cookies, or bearer tokens during debugging.
- A docs page auto-fills your real key into a sample request while the recorder is running.
- A failed request logs the full connection string or secret value in an error panel.
Where Safe Screen Share fits
Safe Screen Share is for legitimate calls, demos, recordings, and tutorials where you need the real page visible but not every private detail on it. It runs locally in your browser, detects sensitive fields like emails, phone numbers, payment data, and API keys, and can turn on automatically when a meeting starts.
You can add Safe Screen Share to your browser or see the pricing. It is a one-time purchase, not a subscription.
Related guides
Frequently asked questions
Is blurring an API key enough?
For prevention, yes, if the raw key never appears in the recording. If the key was visible even briefly, rotate it.
Can YouTube compression hide a key?
No. Do not depend on compression or low resolution. Keys can still be readable or recoverable from frames.
Should I use fake keys in tutorials?
Yes. Fake or test keys are the safest option when the exact value does not matter.