SDK quickstart: mask and unmask

The SDKs call Maskflare's masking directly, for text that never goes through the gateway: documents you store, prompts you build for a model Maskflare doesn't proxy, logs. They apply the masking rules of the key's environment.

1. Create a Redaction key

Under API keys choose Create key, purpose Redaction. A redaction key can only mask and unmask: it can't forward provider traffic, so a leaked key never spends your AI budget.

2. Install and mask

pip install maskflare

from maskflare import Maskflare

client = Maskflare(api_key="mf_live_...", base_url="https://YOUR_GATEWAY_HOST")
result = client.mask("Contact ada@example.com for details")
# result.output -> "Contact mf_mask_170b85... for details"
# result.tokens -> [MaskedToken(token="170b85...", rule_key="email")]

restored = client.unmask_text(result.output)
# -> "Contact ada@example.com for details"

npm install @maskflare/sdk

import { Maskflare } from "@maskflare/sdk";

const client = new Maskflare({ apiKey: process.env.MASKFLARE_API_KEY!, baseUrl: "https://YOUR_GATEWAY_HOST" });
const { output, tokens } = await client.mask("Contact ada@example.com for details");
const reply = await client.unmaskText(output);

Tokens resolve for 30 days. deterministic: true gives the same value the same stand-in every time (EMAIL_...), which keeps embeddings and search working; subject_tenant scopes stand-ins to one of your own customers.

3. Handle errors

Errors carry the problem code and detail. A block rule's match raises with `sensitive_data_blocked` and names the rules, never the value.