Local secret redaction

PromptLatch

PromptLatch runs locally and redacts credentials from LLM request content before sending it to a provider.

Start Verify GitHub

Artifacts Open source, MIT

Releases include Docker, Helm, and Homebrew packages. Release tags are signed.

Detection Deterministic local rules

Provider patterns, bc-detect-secrets, and custom tail or regex rules.

Logging Redacted audit logs

Logs omit matched values and include counts and rule names.

API OpenAI-compatible

Chat Completions, Responses API, legacy completions, models, and pass-through routes.

Verify

Check what leaves your machine.

Send a fixture token to a public echo endpoint and inspect the forwarded body. A model reply cannot verify the forwarded request.

brew tap bvolpato/tap
brew install promptlatch
promptlatch init
promptlatch serve

FAKE_KEY="AI""zaSyFixtureToken000000000000000000000"
curl --compressed -fsS http://127.0.0.1:8000/post \
  -H "X-Target-Base-URL: https://postman-echo.com" \
  -H "Content-Type: application/json" \
  -d '{"messages":[{"content":"GEMINI_API_KEY='"$FAKE_KEY"'"}]}' \
  | jq -r '.data.messages[0].content'

# GEMINI_API_KEY=[REDACTED_SECRET]

Install

Install proxy or library.

Run the proxy for existing clients, or add the Python library to redact prompts and request data inside your application.

brew tap bvolpato/tap
brew install promptlatch
promptlatch init --target-base-url https://api.openai.com/v1
export OPENAI_API_KEY="<openai-upstream-key>"
promptlatch serve

uv tool install promptlatch
promptlatch doctor

uv add promptlatch
# or
python -m pip install promptlatch

Proxy mode

Choose upstream in config or per request.

PromptLatch redacts JSON and text bodies, forwards the original route, and leaves provider-specific fields intact. Set one default target, or send per-request target headers.

OpenAI default

curl http://127.0.0.1:8000/v1/responses \
  -H "X-Target-Base-URL: https://api.openai.com/v1" \
  -H "X-Target-API-Key: $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-6-sol","input":"Reply exactly: ok"}' \
  | jq -r '.output[0].content[0].text'

Config default

target:
  default_base_url: https://api.openai.com/v1
  api_key: ${OPENAI_API_KEY}
  api_key_header: authorization
redaction:
  engine: detect-secrets
  redact_mode: full

OpenRouter request

# config.yaml
target:
  allowed_base_urls:
    - https://openrouter.ai/api/v1

curl http://127.0.0.1:8000/v1/responses \
  -H "X-Target-Base-URL: https://openrouter.ai/api/v1" \
  -H "X-Target-API-Key: $OPENROUTER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"openai/gpt-oss-120b","input":"Reply exactly: ok"}'

Anthropic-compatible

curl http://127.0.0.1:8000/v1/messages \
  -H "X-Target-Base-URL: https://api.anthropic.com" \
  -H "X-Target-API-Key: $ANTHROPIC_API_KEY" \
  -H "X-Target-API-Key-Header: x-api-key" \
  -H "anthropic-version: 2023-06-01" \
  -H "Content-Type: application/json" \
  -d '{"model":"claude-opus-4-8","max_tokens":64,"messages":[{"role":"user","content":"Reply exactly: ok"}]}'

Local Ollama/vLLM

target:
  default_base_url: http://127.0.0.1:11434/v1
  allowed_base_urls:
    - http://127.0.0.1:11434/v1
  block_private_targets: false

Routes

/v1/chat/completions
/v1/responses
/v1/completions
/v1/models
/v1/messages

Library

Redact values before SDK calls.

No proxy required. PromptLatch returns a redacted value; pass that returned value to the SDK or HTTP client. It does not intercept or modify SDK calls. If redaction raises an error, do not send the original input.

Prompt text

from openai import OpenAI
from promptlatch import redact_text

client = OpenAI()
prompt = "Inspect config: OPENAI_API_KEY=example-secret-value-123456"
client.responses.create(
  model="gpt-6-sol",
  input=redact_text(prompt),
)

Message arrays

from openai import OpenAI
from promptlatch import redact_messages

client = OpenAI()
messages = [{"role": "user", "content": "GITHUB_TOKEN=example-token-value-123456"}]
safe_messages = redact_messages(messages)

client.chat.completions.create(
  model="gpt-6-sol",
  messages=safe_messages,
)

SDK parameters

from openai import OpenAI
from promptlatch import redact_params

client = OpenAI()

safe_params = redact_params(
  model="gpt-6-sol",
  input="Authorization: Bearer FixtureToken000000000000000000000",
)
client.responses.create(**safe_params)

Structured payloads

import os
import httpx
from promptlatch import redact_payload

payload = {
  "model": "gpt-6-sol",
  "input": [{"role": "user", "content": [
    {"type": "input_text", "text": "OPENAI_API_KEY=example-secret-value-123456"}
  ]}],
}
httpx.post(
  "https://api.openai.com/v1/responses",
  headers={"Authorization": f"Bearer {os.environ['OPENAI_API_KEY']}"},
  json=redact_payload(payload),
)

LiteLLM

from litellm import completion
from promptlatch import redact_params

completion(**redact_params(
  model="openai/gpt-6-sol",
  messages=[{"role": "user", "content": "GEMINI_API_KEY=example-key-value-123456"}],
))

LangChain

from langchain_openai import ChatOpenAI
from promptlatch import redact_messages

llm = ChatOpenAI(model="gpt-6-sol")
llm.invoke(redact_messages([
  ("human", "token=example-token-value-123456"),
]))

Helpers return new redacted values and leave input data unchanged. Use scan_text, scan_messages, scan_params, or scan_payload to inspect redaction counts. Keep provider authentication in SDK configuration; these helpers redact application request content.

Agent configs

Point coding agents at local proxy.

Codex

model = "openai/gpt-oss-120b"
model_provider = "promptlatch-openrouter"

[model_providers.promptlatch-openrouter]
name = "PromptLatch OpenRouter"
base_url = "http://127.0.0.1:8000/v1"
wire_api = "responses"
env_http_headers = { "X-Target-API-Key" = "OPENROUTER_API_KEY" }
http_headers = { "X-Target-Base-URL" = "https://openrouter.ai/api/v1" }

# ~/.codex/openrouter-promptlatch.config.toml
# codex -p openrouter-promptlatch

cp examples/promptlatch-openrouter.config.yaml \
  ~/.config/promptlatch/config.yaml
cp examples/codex-openrouter-promptlatch.config.toml \
  ~/.codex/openrouter-promptlatch.config.toml
export OPENROUTER_API_KEY="<openrouter-upstream-key>"
promptlatch serve
codex -p openrouter-promptlatch

Use a Responses-capable backend. Current Codex custom tools do not fit the Chat Completions bridge.

OpenCode

{
  "$schema": "https://opencode.ai/config.json",
  "provider": {
    "promptlatch-openrouter": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "PromptLatch OpenRouter",
      "options": {
        "baseURL": "http://127.0.0.1:8000/v1",
        "headers": {
          "X-Target-Base-URL": "https://openrouter.ai/api/v1",
          "X-Target-API-Key": "{env:OPENROUTER_API_KEY}"
        }
      },
      "models": {
        "openai/gpt-oss-120b": {
          "name": "gpt-oss via PromptLatch"
        }
      }
    }
  },
  "model": "promptlatch-openrouter/openai/gpt-oss-120b"
}

export OPENROUTER_API_KEY="<openrouter-upstream-key>"
opencode run \
  -m promptlatch-openrouter/openai/gpt-oss-120b \
  "Reply with exactly: promptlatch-opencode-ok"

Claude Code

export PROMPTLATCH_TARGET_BASE_URL="https://api.anthropic.com"
export PROMPTLATCH_TARGET_API_KEY="$ANTHROPIC_UPSTREAM_API_KEY"
export PROMPTLATCH_TARGET_API_KEY_HEADER="x-api-key"
export PROMPTLATCH_SERVER_API_KEY="<local-proxy-key>"
promptlatch serve

export ANTHROPIC_BASE_URL="http://127.0.0.1:8000"
export ANTHROPIC_AUTH_TOKEN="$PROMPTLATCH_SERVER_API_KEY"
export DISABLE_TELEMETRY=1
claude

Limits

Request redaction has a clear boundary.

PromptLatch scans request bodies and query parameters before forwarding. Some credential flows are outside that boundary.

Provider auth is added from config or dedicated target headers after client header filtering.
Unknown private token formats need a custom exact-tail or regex rule.
Multipart uploads and compressed request bodies are rejected while redaction is enabled.
Provider responses pass through without scanning or redaction.
--debug-requests can print raw local request bodies. Use fixture data only.

Deploy

Keep personal proxy on localhost.

For network access, set a target allowlist and a local proxy API key.

Docker

docker run -d --name promptlatch --rm \
  -p 127.0.0.1:8000:8000 \
  --env-file "$HOME/.config/promptlatch/provider.env" \
  ghcr.io/bvolpato/promptlatch:0.2.3

curl --retry 10 --retry-connrefused --retry-delay 1 \
  -fsS http://127.0.0.1:8000/healthz

Helm

kubectl create secret generic promptlatch-env \
  --from-env-file="$HOME/.config/promptlatch/kubernetes.env"

helm install promptlatch \
  https://github.com/bvolpato/promptlatch/releases/download/v0.2.3/promptlatch-0.2.3.tgz \
  --set env.PROMPTLATCH_TARGET_DEFAULT_BASE_URL=https://api.openai.com/v1 \
  --set existingSecret=promptlatch-env

kubectl wait deployment/promptlatch --for=condition=Available --timeout=90s
export PROMPTLATCH_SERVER_API_KEY="$(kubectl get secret promptlatch-env \
  -o jsonpath='{.data.PROMPTLATCH_SERVER_API_KEY}' | base64 --decode)"
kubectl port-forward svc/promptlatch 8000:8000
curl -fsS http://127.0.0.1:8000/healthz

Coverage

Tested credential formats.

Deterministic patterns cover provider keys, personal access tokens, JWTs, signed URLs, private key blocks, URL credentials, and assignment-style secrets.