AI Agents: Mask Sensitive Values on HTTP Requests
Wong Yi Teng
Business Problem:
When setting up an HTTP request in AI Agent or Workflows, values like API tokens, API keys and authorization headers are shown in plain text. Anyone who can open the settings can read or copy them, even if they only need to edit something else, like the AI Agent’s instructions.
For example:
- A business connects its AI Agent to its online store using an API token in the header.
- A teammate opens the AI Agent to update its instructions and can see the full token.
- The token can be copied elsewhere and used to access the store outside respond.io.
The only way to prevent this today is to stop people from opening those settings at all.
Desired Outcome:
- Users can mark a value as secret in an HTTP request (headers, parameters, body or URL).
- Once saved, secret values are masked (•••) and can only be replaced, not viewed again.
- Values that use variables (e.g. $contact.phone) stay visible and editable.
- Works the same way in AI Agent HTTP requests and Workflow HTTP Request steps.