> For the complete documentation index, see [llms.txt](https://docs.luciq.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.luciq.ai/product-guides-and-integrations/product-guides/luciq-pii-masking/network-log-masking.md). # Network Log Masking How Luciq masks network logs on the client, with automatic masking of known-sensitive headers and query keys plus obfuscation you control. Network obfuscation and masking take place on the client side; masked data is never sent to the servers. There are two layers: automatic masking of known-sensitive keys, and manual obfuscation/omission controlled by the developer. #### Automatic header & query-parameter masking Starting with SDK version 14.2.0, the SDK automatically masks a defined set of keys from network headers and query parameters so that no sensitive value reaches the servers. The key name is still shown on the dashboard, but its value is replaced with an asterisk (\*). This feature is enabled by default and is strongly recommended to stay enabled.

Category	Keys masked (value replaced with *)
Authorization	Authorization, authorization_token, auth_token, auth , access_token, token , oauth_token, bearer_token, refresh_token, jwt_token, jwt
Login	username , password, pwd
API keys	api_key, apikey
Secrets	secret , client_secret, app_secret, consumer_secret

{% hint style="info" %} **Need to mask more keys?** You can add your own header and query parameter names from the dashboard. See [Adding your own masking keys](#adding-your-own-masking-keys) below. {% endhint %} *** #### Adding your own masking keys If your app sends sensitive values under names that aren't in the default list, such as a custom session header or a query parameter that carries a user ID, add those names as masking keys. The SDK masks them on the device the same way it masks the defaults. You manage masking keys in your app's settings, under **Data privacy → Network masking keys**. The page lists every key you've added, along with its type: **Header** or **Query param**. Keys that Luciq support added for your app before this page existed are listed here too, and you can edit or delete them like any other key.

The Network masking keys page under Data privacy in the app settings, listing custom header and query param keys with edit and delete buttons

{% hint style="info" %} The **Data privacy** section only shows for apps that have automatic network masking turned on. If you don't see it, contact support. Anyone who can view your app settings can see the page, but only members with permission to manage app settings can add, edit, or delete keys. {% endhint %} **Add masking keys** 1. Click **Add masking keys**. 2. Enter the key name, and choose whether it's a **Header** or a **Query param**. 3. To add more than one key at once, click **Add key** for another row. 4. Click **Add**.

The Add masking keys dialog with two rows: Session-Token as a header and payment_address as a query param

Each key must follow these rules. The dialog flags a key that breaks one as you type. * It can't contain spaces, and it can be up to 255 characters long. * It can't already be one of the [default keys](#automatic-header-and-query-parameter-masking) or one of your own keys of the same type. The check ignores case. * Each type can hold up to 100 keys. The same name can be added once as a header and once as a query parameter. Each one masks only its own type. **Edit a masking key** Click the edit button on the key's row, change the name, and click **Save**. You can rename a key, but you can't change its type. To move a key to the other type, delete it and add it again with the new type. **Delete a masking key** Click the delete button on the key's row, then click **Delete key** to confirm. The key stops being masked in network logs captured from then on. Logs that were already masked stay masked. **View the default keys** Click **View default keys** to see the keys the SDK always masks. They apply to both headers and query parameters, and you can't edit or remove them.

The Default masking keys dialog, listing the keys the SDK always masks, grouped into auth tokens, credentials, API keys, and secrets

**How matching works** * A key matches a header or query parameter with exactly the same name, ignoring case. `X-Session-Id` also masks `x-session-id`. * Different spellings don't match. `access-token` isn't caught by the `access_token` default, so add a key for each spelling your requests use. * Anything not under a masking key is sent as-is. * Changes apply from the next session. You don't need to change your code or release a new app version. *** #### Enabling / disabling automatic network masking Although enabled by default, automatic network masking can be turned off per platform if absolutely necessary: ***Kotlin*** ``` Instabug.setNetworkAutoMaskingState(Feature.State.DISABLED) ``` ***Java*** ``` Instabug.setNetworkAutoMaskingState(Feature.State.DISABLED); ``` ***swift*** ``` NetworkLogger.autoMaskingEnabled = false ``` ***Objective-c*** ``` LCQNetworkLogger.autoMaskingEnabled = false; ``` *** #### Manual obfuscation & omission Beyond automatic key masking, developers can obfuscate specific request/response content or omit a request entirely. The APIs differ per platform: #### Omit a whole request **Android** Android routes obfuscation/omission through the interceptor + listener model (LuciqOkhttpInterceptor, LuciqNetworkLog), with an API to remove the listener. [here](https://docs.luciq.ai/android/set-up-luciq-for-android/logs-and-profiling/unified-network-interception#modifying-network-logs) **iOS** ``` let path = \"/products\" let requestPredicate = NSPredicate(format: \"URL.path MATCHES %@\", path) let responsePredicate = NSPredicate(format: \"statusCode >= %d AND statusCode <= %d\", 200, 399) NetworkLogger.setNetworkLoggingRequestFilterPredicate(requestPredicate, responseFilterPredicate: responsePredicate) ``` **ReactNative**

NetworkLogger.setRequestFilterExpression(
  "network.requestHeaders['accept'] === 'application/json'");

**Flutter** ``` NetworkLogger.omitLog((data) => data.url.contains('/payment')); ``` #### Obfuscate parts (without dropping the request) **iOS** ``` // Obfuscate Request NetworkLogger.setRequestObfuscationHandler { (request) -> URLRequest in var myRequest:NSMutableURLRequest = request as! NSMutableURLRequest let urlString = request.url?.absoluteString urlString = obfuscateAuthenticationTokenInString() let obfuscatedURL = URL(string: urlString) myRequest.url = obfuscatedURL return myRequest.copy() as! URLRequest } //Obfuscate Response NetworkLogger.setResponseObfuscationHandler { (data, response, completion) in if let data = data { let modifiedData = self.modify(data: data) let modifiedResponse = self.modify(response: response) completion(modifiedData, modifiedResponse) } } ``` **ReactNative** ``` NetworkLogger.setNetworkDataObfuscationHandler(async (networkData) => { networkData.requestHeaders = { 'Content-Type': 'application/json' }; return networkData; }); ``` **Flutter** ``` NetworkLogger.obfuscateLog((data) { data.requestHeaders.remove('Authorization'); return data; }); ``` {% hint style="info" %} Find more at each platform docs [Android](https://docs.luciq.ai/references/report-data/logging/network-logging-android), [iOS](https://docs.luciq.ai/references/report-data/logging/network-logging-ios#omitting-requests-from-logs), [ReactNative](https://docs.luciq.ai/react-native/setup-luciq-for-react-native/logs-and-profiling/report-logs#omitting-requests) and [Flutter](https://docs.luciq.ai/flutter/setup-luciq-for-flutter/logs-and-profiling/report-logs#obfuscating-data) {% endhint %} *** #### Payload masking options * Entire request/response payloads can be omitted based on request or response details. * Selective masking can be applied, masking only the sensitive parts of the payload. In practice this is the obfuscation handler in 3.3 used selectively — clear or rewrite a single field rather than the whole payload, e.g. Flutter data.responseBody = '' or React Native networkData.response = {}. * All payload masking happens client-side; masked data never reaches the servers. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.luciq.ai/product-guides-and-integrations/product-guides/luciq-pii-masking/network-log-masking.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.