Encryption

Encrypt selected sensitive values before they are written to SQLite.

Encryption is optional. When configured, ServerDevTools uses AES-256-GCM with a base64-encoded 32-byte key and recursively encrypts matching object field names.


encryption: {
  key: process.env.SERVER_DEVTOOLS_ENCRYPTION_KEY!,
  fields: ["password", "authorization", "apiKey"],
}

Without fields, the default names are password, accessToken, refreshToken, authorization, and cookie. Providing fields replaces that list; it does not extend it.

Generate a key with:


node -e 'console.log(require("node:crypto").randomBytes(32).toString("base64"))'

Encryption at rest is not redaction. Captured values can still be visible in the dashboard after decryption, and fields whose names are not configured are not encrypted by this service. Encryption covers supported request/response metadata, current-user metadata, and outbound HTTP details; it is not whole-database encryption. Header redaction is a separate feature covering configured HTTP header values before persistence, not bodies, URL/query values, or arbitrary span attributes.