Skip to content
Maskflare
Talk to usStart free trial
Menu

For your apps · Maskflare SDKs & API

Mask and Unmask Sensitive Data From Your Own Code

Python and TypeScript SDKs and a REST API for masking text anywhere: before a model call, before a log line, before a row lands in your warehouse. Tokens come back as real values when you need them, for 30 days.
Start free trial Talk to us
28-day free trial or 10,000 requests, whichever comes first. No card needed.

What your app sends

Summarize the ticket from

Ada Lovelace (ada@example.com)

about invoice DE89 3704 0044 0532 0130 00

and suggest a reply.

Maskflare

What OpenAI receives

Summarize the ticket from

mf_mask_170b (mf_mask_5e1d)

about invoice mf_mask_2f6c

and suggest a reply.

POST /v1/openai/chat/completions · 3 values masked · restored in the reply

574

Built-in detectors for personal data and secrets

47

Country packs, checksum-validated where the format has one

9

AI providers behind one gateway, plus the desktop agent and proxy

Sound familiar?

Why the usual answers fall short

“We have a regex for emails.”

And IBANs, national IDs, API keys and names? Each country's ID has its own checksum.

“We hash everything.”

Then nobody can read the support reply back to the customer. Masking is reversible when you need it.

“We'll mask it in the gateway.”

Great for model calls. Your logs and data pipelines never go through it.

Not every place personal data leaks is a model call. Logs, support exports, analytics events and evaluation datasets all collect the same names and account numbers.

Writing your own detection for each of those means maintaining regexes and checksums in several languages, and deciding where the mapping back to real values lives.

How Maskflare SDKs & API works

Call mask with any text and get back the masked output plus the tokens. Store, log or send the masked text. When you need the real values, call unmask with the tokens or unmask_text with a whole string. Deterministic mode gives the same value the same token, which keeps search and embeddings working over masked data. The SDKs use a redaction-purpose key that can't call the forwarding routes, so a leaked SDK key can't spend your provider budget.

Benefits

Python and TypeScript

pip install maskflare, or the zero-dependency TypeScript SDK for Node 18+, Deno, Bun and Workers.

Reversible for 30 days

Tokens resolve back to real values for 30 days, then expire.

Deterministic mode

Same value, same token, for RAG, search and joins over masked data.

Sensitive wrapper

Wrap values in Sensitive so they never print in your own logs or tracebacks.

LiteLLM guardrail

maskflare[litellm] drops into an existing LiteLLM proxy as a pre- and post-call guardrail.

Exact Data Match CLI

maskflare[edm] hashes your customer records locally and uploads only keyed hashes.

Capabilities

Python

MaskFlare and AsyncMaskFlare clients with mask, unmask and unmask_text; deterministic=True; Sensitive; extras for LiteLLM and EDM.

TypeScript

MaskFlare client with mask, unmask and unmaskText; zero dependencies; server-side runtimes.

REST API

The same mask, unmask and match operations over HTTP for any other language or system.

Set it up

Python
import os
from maskflare import MaskFlare

client = MaskFlare(api_key=os.environ["MASKFLARE_API_KEY"])

result = client.mask("Contact ada@example.com for details")
# result.output: "Contact mf_mask_170b8521c1b944b3beb9ca02b328efbe for details"

original = client.unmask([t.token for t in result.tokens])
# {"170b8521c1b944b3beb9ca02b328efbe": "ada@example.com"}
TypeScript
import { MaskFlare } from '@maskflare/sdk';

const client = new MaskFlare({
  apiKey: process.env.MASKFLARE_API_KEY!,
  baseUrl: process.env.MASKFLARE_BASE_URL!,
});

const { output, tokens } = await client.mask('Contact ada@example.com for details');
// output: "Contact mf_mask_170b8521c1b944b3beb9ca02b328efbe for details"
LiteLLM proxy config
guardrails:
  - guardrail_name: maskflare
    litellm_params:
      guardrail: maskflare.integrations.litellm.MaskflareGuardrail
      mode: [pre_call, post_call]
      default_on: true
      api_key: os.environ/MASKFLARE_API_KEY
      fail_policy: closed

What it does not do

We'd rather you hear it from us.

Explore related capabilities

See how Maskflare applies the same masking rules to related AI and data-protection workflows.

Maskflare Detection EngineMaskflare AI GatewayMaskflare Forward ProxyMaskflare Exact Data MatchMaskflare File SecurityMaskflare AI App Discovery & ControlMaskflare User CoachingMaskflare WorkforceMaskflare Browser ProtectionMaskflare Agent & MCP SecurityMaskflare Coding AgentsMaskflare Admin Console

Related guides and explainers

Frequently asked questions

How do I install the SDKs?

pip install maskflare for Python, and the @maskflare/sdk package for TypeScript. Both need a Maskflare API key.

Can I unmask values later?

Yes, for 30 days after the token was created, using the API key's organization. After that the token expires.

What is deterministic mode?

With deterministic=True the same value always becomes the same token, so you can search, join and embed masked text consistently.

Do I need the gateway as well?

Not for masking your own text. Use the gateway when you want model calls masked and restored automatically without code changes.

See it on your own data

Try Maskflare free.
Bring your hardest prompts.

28-day free trial or 10,000 requests, whichever comes first. Point one app at the gateway or enroll a few laptops,
and watch what gets masked. Or talk to us first.

Start free trial Talk to us