Developers
Add Maskflare to your AI stack in minutes
input: [EMAIL_1] model: approved restore: boundary-only
1. Gateway: change the base URL
Point the provider's own SDK at your Maskflare gateway and authenticate with a Maskflare API key. Personal data, secrets, and your own customer records are replaced with mf_mask_ tokens before the request leaves. Turn on response restoration for the API key and the real values are put back in the response, streaming included. Your provider key is stored once in the console, or sent per request in pass-through mode.
from openai import OpenAI
# Your Maskflare gateway URL and API key come from your workspace.
client = OpenAI(
base_url="https://YOUR_GATEWAY_HOST/v1/openai",
api_key="mf_live_...", # a Maskflare key, not your OpenAI key
)
reply = client.chat.completions.create(
model="gpt-4o",
messages=[{"role": "user", "content": "Draft a reply to ada@example.com about invoice DE89 3704 0044 0532 0130 00"}],
)
# OpenAI received opaque mf_mask_ tokens. With response restoration on for
# this key, the reply contains the real values again.from anthropic import Anthropic
client = Anthropic(
base_url="https://YOUR_GATEWAY_HOST/v1/anthropic",
api_key="mf_live_...",
)| Provider | Gateway path |
|---|---|
| OpenAI | /v1/openai |
| Anthropic | /v1/anthropic |
| Google Gemini | /v1/gemini |
| Mistral | /v1/mistral |
| xAI (Grok) | /v1/xai |
| DeepSeek | /v1/deepseek |
| Groq | /v1/groq |
| Together AI | /v1/together |
| Ollama (self-hosted) | /v1/ollama |
2. Forward proxy: no code change
Set Maskflare as the HTTPS proxy and trust your organization's Maskflare certificate. Traffic to the supported AI providers is inspected and masked; every other host is tunnelled untouched. Optional browser protection covers prompts typed into ChatGPT, Claude, Gemini, DeepSeek and Perplexity on the web. On managed devices, the Workforce desktop agent sets this up for you.
# The Maskflare key authenticates the proxy; your provider key is stored in the console.
curl -x http://YOUR_PROXY_HOST -U "mf_live_...:" \
https://api.openai.com/v1/chat/completions -d @request.json3. SDKs: mask and unmask anywhere
For pipelines that don't call a model directly, such as logs, tickets, or RAG ingestion, mask text with a redaction-only API key and resolve tokens later. A redaction key can't forward AI traffic, so a leaked key can't spend your provider budget.
pip install maskflare
from maskflare import MaskFlare
client = MaskFlare(api_key="mf_live_...", base_url="https://YOUR_GATEWAY_HOST")
result = client.mask("Contact ada@example.com for details")
# result.output -> "Contact mf_mask_170b8521c1b944b3beb9ca02b328efbe for details"
original = client.unmask_text(result.output)- Python SDKpip install maskflare (sync and async clients)
- TypeScript SDKnpm install @maskflare/sdk (Node 18+, Deno, Bun, Workers)
- Coding-agent hooksmaskflare-hook install claude-code | cursor | codex
- Admin MCP serveruvx maskflare-mcp
- LiteLLM guardrailpip install "maskflare[litellm]"
- Exact Data Match CLIpip install "maskflare[edm]"
- HTTP APIPOST /v1/mask, /v1/unmask
What gets detected
574 built-in detectors: emails, phone numbers, payment cards, IBANs and bank accounts, national IDs and tax numbers for 47 countries (checksum-validated where the format has one), health identifiers, person names (word lists plus a local named-entity layer), and 232 API-key and credential formats. Add your own regex rules, term dictionaries, allowlists, and Exact Data Match against your customer records. Each rule can mask, redact, partially show, hash, encrypt, generalize, alert, warn, or block.
Try detection on your own text with the free PII Prompt Checker, or read the technical overview.