# HAR File Sanitizer - Remove Cookies & Tokens Before Sharing (`that_red_bird/har-file-sanitizer`) Actor

Sharing a HAR with support leaks session cookies, bearer tokens and API keys. This strips cookies, auth headers, JWTs, secret query and form fields, optionally emails, and returns a clean HAR with a change log plus a performance and third-party summary. Runs offline.

- **URL**: https://apify.com/that_red_bird/har-file-sanitizer.md
- **Developed by:** [mohamed alaya](https://apify.com/that_red_bird) (community)
- **Categories:** Developer tools, Automation, Other
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$5.00 / 1,000 har sanitizeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## HAR File Sanitizer - Remove Cookies & Tokens Before Sharing

Strips session cookies, bearer tokens, API keys, secret query parameters and form passwords out of HAR files, so you can attach them to a support ticket without leaking a login. You also get a change log and a quick performance and third-party summary.

Made for support engineers, QA teams, SaaS vendors and AI agents that receive HAR files from customers. It runs offline on the JSON: no browser, no proxy, nothing is sent to a third party.

### Input examples

Clean a file from a link:

```json
{ "harUrls": ["https://example.com/uploads/customer-session.har"] }
```

Clean a pasted HAR and also remove all response bodies (smallest, safest file):

```json
{ "harJson": "{\"log\":{\"entries\":[]}}", "dropResponseBodies": true }
```

Clean every HAR in a key-value store, keep IP addresses, treat two extra headers as secret:

```json
{ "keyValueStoreId": "YOUR_STORE_ID", "redactIps": false, "extraSensitiveNames": ["x-tenant-secret", "x-customer-id"] }
```

Leave the input empty to see a demo on a built-in HAR with fake secrets.

### Input guide

| Field | What it does |
|---|---|
| `harUrls`, `harJson`, `keyValueStoreId` + `recordKeys` | Where the HAR files come from. Mix as you like. |
| `redactCookies`, `redactAuthHeaders`, `redactQueryParams`, `redactBodies` | On by default. Each switch controls one family of redactions. |
| `redactPii` | Emails, Luhn-valid card numbers, US SSNs and fields called email, phone, address and similar. |
| `redactIps` | Replaces `serverIPAddress` and client IP fields. Off by default. |
| `dropResponseBodies` | Deletes response body text completely. |
| `extraSensitiveNames` | Your own header, query, form or JSON names to always redact. |
| `firstPartyDomains` | Which domains are "yours" in the third-party summary. Default: domain of the first HTML document. |

### Output

One dataset row per HAR, plus two files in the run's key-value store: the cleaned HAR (`sanitized-N-name.har`) and a change log (`changelog-N-name.json`). Both have a link in the row.

| Field | Meaning |
|---|---|
| `entries` | Number of requests in the HAR |
| `redactions`, `byCategory` | How many values were replaced, by family (`cookie`, `auth-header`, `query-secret`, `body-secret`, `secret-field`, `pii`, `token`, `api-key`) |
| `sanitizedHarUrl`, `changeLogUrl` | Links to the cleaned file and the change log |
| `performance` | Requests, transfer, load timings, status classes, types, slowest and largest requests |
| `thirdParties` | Third-party domains with category guess, request count, bytes, and whether they set cookies |

Sample row (shortened):

```json
{ "type": "har", "name": "demo-har", "entries": 8, "redactions": 23,
  "byCategory": { "cookie": 7, "auth-header": 2, "query-secret": 1, "body-secret": 5, "pii": 5 },
  "sanitizedHarUrl": "https://api.apify.com/v2/key-value-stores/.../records/sanitized-1-demo-har.har",
  "thirdParties": { "domains": 3, "requests": 3, "sharePctOfRequests": 38 } }
```

The change log lists where each redaction happened (entry number, host and path, field, rule). It never contains the secret values.

### Use it with

- A support form or ticket webhook: send the uploaded HAR URL, attach the cleaned file instead.
- An AI agent that triages bug reports: call the Actor through the API or MCP and read `sanitizedHarUrl`.
- Website Content Crawler or any Actor that stores HAR files in a key-value store: point `keyValueStoreId` at it.

### FAQ

**Is the result guaranteed secret-free?** No. The rules cover the common shapes (see limits). Always glance at the change log and search the output for anything specific to your product before sharing outside your company.

**Does it change the timings?** No. Only strings are replaced. Sizes, timings and structure stay the same, so the file still loads in Chrome DevTools.

**Are bodies in base64 checked?** No. Binary bodies are counted in `binaryBodiesNotScanned`; use `dropResponseBodies` if they might hold secrets.

### Honest limits

- Rule-based, not a guarantee. Secrets with unusual names inside free-text bodies, or custom token formats, may survive: add them to `extraSensitiveNames` or use `dropResponseBodies`.
- `state`, `code` and `key` query parameters are redacted on purpose, which can hide harmless values.
- Third-party categories come from a small built-in domain list; unknown domains are `other`.
- Files are held in memory (default limit 60 MB).

### Price

Pay per event: **$0.005 per HAR file sanitized** (`har-sanitized`). Cleaning 100 HAR files costs $0.50. Files that fail to parse are not charged.

# Actor input Schema

## `harUrls` (type: `array`):

Public or signed URLs of .har files to sanitize (for example a link from a ticket or a cloud bucket). Leave everything empty to run on a built-in demo HAR with fake secrets.

## `harJson` (type: `string`):

Paste the full contents of one HAR file here. Useful for a single quick clean from an API call or an AI agent. Large files should use a URL or a key-value store instead.

## `keyValueStoreId` (type: `string`):

Pick a key-value store that holds HAR files. If you leave 'Record keys' empty, every record ending in .har or .json (up to 200) is processed.

## `recordKeys` (type: `array`):

Only these records of the selected key-value store are processed. Leave empty to process all .har and .json records.

## `redactCookies` (type: `boolean`):

Replace the value of every Cookie / Set-Cookie header and cookie object. Cookie names are kept so the file stays useful for debugging.

## `redactAuthHeaders` (type: `boolean`):

Replace Authorization, Proxy-Authorization, X-Api-Key, CSRF and any header whose name contains token, secret, key or session. The auth scheme (Bearer, Basic) is kept.

## `redactQueryParams` (type: `boolean`):

Replace the value of query parameters such as access_token, api_key, signature, password, code and state, in URLs, redirects and the queryString lists.

## `redactBodies` (type: `boolean`):

Redact secret-looking fields in JSON and form bodies (password, token, secret, card number) and JWTs, bearer tokens, cloud keys and private keys found anywhere in body text.

## `redactPii` (type: `boolean`):

Also redact email addresses, card numbers (Luhn-checked), US social security numbers and fields named email, phone, first name, address and similar.

## `redactIps` (type: `boolean`):

Replace the serverIPAddress and client IP fields of every entry. Off by default because server IPs are often useful for support.

## `dropResponseBodies` (type: `boolean`):

Delete the response content text entirely. Safest option and makes the file much smaller. Timings, sizes and headers are kept.

## `extraSensitiveNames` (type: `array`):

Header, query, form or JSON field names to always redact, matched exactly and case-insensitively, for example x-tenant-secret or customer_id.

## `firstPartyDomains` (type: `array`):

Domains that count as your own site in the third-party summary, for example example.com. Leave empty to use the domain of the first HTML document in the HAR.

## `maxHarMb` (type: `integer`):

Files larger than this are skipped with an error row. HAR files are loaded fully into memory, so keep this reasonable.

## Actor input object example

```json
{
  "harUrls": [],
  "harJson": "",
  "recordKeys": [],
  "redactCookies": true,
  "redactAuthHeaders": true,
  "redactQueryParams": true,
  "redactBodies": true,
  "redactPii": true,
  "redactIps": false,
  "dropResponseBodies": false,
  "extraSensitiveNames": [],
  "firstPartyDomains": [],
  "maxHarMb": 60
}
```

# Actor output Schema

## `results` (type: `string`):

No description

## `downloadCsv` (type: `string`):

No description

## `summary` (type: `string`):

No description

## `count` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "harUrls": [],
    "harJson": "",
    "recordKeys": [],
    "redactCookies": true,
    "redactAuthHeaders": true,
    "redactQueryParams": true,
    "redactBodies": true,
    "redactPii": true,
    "redactIps": false,
    "dropResponseBodies": false,
    "extraSensitiveNames": [],
    "firstPartyDomains": [],
    "maxHarMb": 60
};

// Run the Actor and wait for it to finish
const run = await client.actor("that_red_bird/har-file-sanitizer").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "harUrls": [],
    "harJson": "",
    "recordKeys": [],
    "redactCookies": True,
    "redactAuthHeaders": True,
    "redactQueryParams": True,
    "redactBodies": True,
    "redactPii": True,
    "redactIps": False,
    "dropResponseBodies": False,
    "extraSensitiveNames": [],
    "firstPartyDomains": [],
    "maxHarMb": 60,
}

# Run the Actor and wait for it to finish
run = client.actor("that_red_bird/har-file-sanitizer").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "harUrls": [],
  "harJson": "",
  "recordKeys": [],
  "redactCookies": true,
  "redactAuthHeaders": true,
  "redactQueryParams": true,
  "redactBodies": true,
  "redactPii": true,
  "redactIps": false,
  "dropResponseBodies": false,
  "extraSensitiveNames": [],
  "firstPartyDomains": [],
  "maxHarMb": 60
}' |
apify call that_red_bird/har-file-sanitizer --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,that_red_bird/har-file-sanitizer"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/qXTeWcW3n3mRKxVG5/builds/JY7YHSjJo8dmFbL3X/openapi.json