You have a failing request in front of you and someone who can help with it — a teammate, or a vendor's support engineer. The fastest way to move is to hand over the actual capture. But that capture is not clean: it carries an Authorization: Bearer token, session cookies, and personal data in the request and response. None of that should leave your Mac in cleartext.
The outcome of this guide is a capture you can share without leaking anything: you redact the secrets and PII inside Rockxy first, then export a HAR or create a Workspace share link from the already-masked flow. The order is the whole point — redact locally, share second — and you verify the masking before the file or link goes anywhere.
Why "just delete the token line" is not enough
Secrets in a captured HTTP flow are not in one place. A single authenticated request can carry the same credential in several forms at once:
- An
Authorizationheader with a bearer or basic token. CookieandSet-Cookieheaders with a session identifier.- API keys or tokens echoed in a JSON request or response body.
- Personal data — names, emails, addresses — in the payload of a real account.
Hand-editing an exported file to catch all of that is error-prone, and it happens after the secret has already been written to disk. Rockxy's Redaction works the other way around: you mask the fields inside the app, and the export or share reads from the masked view. The credential never has to be copied out first.
What you will need
- Rockxy on macOS 14 (Sonoma) or later. It is a native app; download it from the Rockxy download page.
- At least one captured flow you actually want to share — the failing request, with its real headers and body.
- A destination in mind: a HAR file you will send, or a Workspace share link. Workspace sharing is part of the Team tier ($9/seat/month); HAR export is available in the free app.
- A short mental list of what counts as sensitive in your capture: authorization headers, cookies, bearer tokens, and any PII in the bodies.
Step 1 — Capture the flow you intend to share
Reproduce the problem in Rockxy so the exact failing request is in the traffic list. Select it and read what is actually in it: the request headers, the request body, the response, and the timing. This is the moment to notice every sensitive field, because these are the fields you are about to mask.
If you have never captured a local request before, the localhost capture guide covers getting the flow into Rockxy in the first place. Start there, then come back to redact it.
Step 2 — Redact secrets and PII inside Rockxy
Use Rockxy's Redaction to mask the sensitive fields before anything is exported. Redaction can cover authorization headers, cookies, bearer tokens, and PII, so the values are replaced with a masked placeholder in the view that export and sharing read from.
Work through the flow field by field: mask the Authorization header, the Cookie and Set-Cookie headers, any token echoed in the body, and the personal data belonging to a real account. The exact controls and where they live in the interface are in the Redaction docs; the rule to carry with you is that every sensitive field has to be masked before you move on, not after you export.
What you should see in Rockxy: when you re-select the flow, the fields you masked no longer show their real values — the token, cookie, and PII read as a redacted placeholder in the detail view. If any real value is still visible, it is not yet redacted, and it will still be present in an export made right now.
Step 3 — Export a HAR or create a Workspace link from the masked flow
Only after the fields are masked do you produce the thing you will hand off.
For a file: export the flow to HAR. Because the export reads from the redacted view, the masked fields are masked in the file. HAR is plain JSON, so the person you send it to can open it in Rockxy or any HAR-aware tool. If you want the round trip — sending a HAR out, or importing one you received — the HAR export and import guide walks through it.
For a link: create a Workspace share link. On the Team tier, Rockxy turns a local capture into a sanitized, scoped browser link your teammate can open without installing anything — the recipient sees the flow you shared, not your whole session. Because you redacted first, the link is built from the masked flow. The team sharing guide covers the sharing workflow end to end.
What you should see: open the export or the link yourself before you send it, and confirm the masked fields are still masked in the handed-off view. This one look is the difference between redaction you assumed and redaction you verified.
The one ordering mistake to avoid
A HAR file or a share link created before you redacted still contains the original secrets. Masking the flow afterward does not reach back into a file already written or a link already generated — those are frozen copies of the unredacted data.
So if you exported first and redacted second, throw away that first artifact and export again from the masked flow. Treat any pre-redaction file or link as compromised: delete it, and if it was a share link, revoke it. The safe sequence is always redact, verify, then export or share — never the reverse.
If it does not work
A masked value still shows up in the exported HAR. The field was not covered by redaction before the export ran. Re-open the flow, confirm the field reads as a placeholder in Rockxy's detail view, then export again — and discard the earlier file.
A token appears in the body, not a header. Header masking alone will not catch a credential echoed inside a JSON payload. Redact the body field as well, then re-verify the response and request bodies before sharing.
You do not see a Workspace share option. Workspace sharing is the Team tier ($9/seat/month). HAR export is still available in the free app, so you can redact and export a file even without a Team seat. See Workspace for what the Team tier adds.
You are not sure the redaction is complete. Then it is not ready to share. Redaction is your responsibility to verify: open the artifact you are about to hand off and read the fields that used to hold secrets. If any real value survives, the capture is not safe to send yet.
Limitations to keep in mind
- Redaction is a tool, not a guarantee. Verifying that every sensitive field is masked before sharing is on you — check the exported or shared view every time.
- A HAR or link produced before redaction still contains the secrets. Re-export after redacting, and treat the earlier artifact as leaked.
- Workspace share links are the Team tier ($9/seat/month). The free app can still redact and export a HAR.
- Rockxy is macOS-only today (Sonoma 14+). Redaction, HAR export, and Workspace sharing all run on the Mac.
Next steps
The rule is short: a capture is full of credentials by default, so mask them in Rockxy first and only then produce a HAR or a share link — and open the result to confirm before you send it.
From here, read the local debugging, TLS, and redaction overview for how redaction fits with local-first security, use the HAR export and import guide when you are moving files around, or set up team sharing when a link beats a file. If you do not have the app yet, start on the download page.
