{"version":"2.1.216","anchor":"jwt-credential-masking-for-sandbox-environments","canonical_anchor":"jwt-credential-masking-for-sandbox-environments","heading":"JWT Credential Masking for Sandbox Environments","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.216\/e\/jwt-credential-masking-for-sandbox-environments","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.216","markdown":"### JWT Credential Masking for Sandbox Environments\n\n**What**\n\nThe `sandbox.credentials.envVars` config now supports `decode: \"jwt\"` to handle JWT tokens: the token is replaced with a structurally valid but fake JWT inside the sandbox, with real claim values masked as sentinels injected into requests.\n\n**Details**\n\n- Add `decode: \"jwt\"` to a `credentials.envVars` entry to activate JWT handling\n- Optional `maskClaims: [\"sub\", \"email\"]` masks specific string claims within the JWT, replacing each with a per-claim sentinel injected at the network layer\n- If the environment variable is not a valid JWT, the variable is left unprotected and a warning is logged\n- If `maskClaims` names a claim that is absent or not a string, that claim is skipped and logged\n- Replaces the previous `extract`-regex-only approach, which remains available for non-JWT values\n\n**Evidence**\n\nJWT masking handler (search for `\"decode \\\"jwt\\\"\"` or `\"maskClaims\"`). Fake token generator (search for `\"pnu = \\\"c3J0LWZha2U\\\"\"` which is the fake signature base64)."}