{"version":"2.1.224","anchor":"sandbox-credential-masking-gains-jwt-handling-per-claim-mask","canonical_anchor":"sandbox-credential-masking-gains-jwt-handling-per-claim-mask","heading":"Sandbox credential masking gains JWT handling, per-claim masking and AWS SigV4 re-signing","tier":"use","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224\/e\/sandbox-credential-masking-gains-jwt-handling-per-claim-mask","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224","markdown":"### Sandbox credential masking gains JWT handling, per-claim masking and AWS SigV4 re-signing\n\nSandbox credential masking can fake JWTs, mask single claims, and re-sign AWS requests after swapping keys.\n\n**What**\n\nCredential entries under `sandbox.credentials` can now use `decode: \"jwt\"` to swap a real token for a structurally valid fake so client-side parsing still works, and `maskClaims` to mask only named claims and rebuild the token. A new `awsPairs` setting groups masked environment variables into access-key, secret and session-token trios so the proxy can re-sign AWS SigV4 requests, and a new `sigv4` block sets deny or passthrough policy for streaming uploads, presigned URLs and SigV4A.\n\n**Details**\n\n- For environment variables, combining `decode` with `extract`, or with a fail-closed `onExtractNoMatch`, is rejected at validation time.\n- SigV4A signatures are asymmetric, so there is no shared key to recompute; the `sigv4` block decides what happens to them.\n- `awsPairs` and `sigv4` are only honored from user settings, managed\/policy settings, or the CLI `--settings` flag, and are now forwarded into the proxy's credential block.\n- At startup, a masked environment variable whose name uses the reserved synthesized-placeholder prefix produces a warning and degrades to `deny`.\n\n**Evidence**\n\n`Policy for SigV4A (AWS4-ECDSA-P256-SHA256) asymmetric signatures: there is no shared-key HMAC to recompute.`, `awsPairs`\n\n- Area: Sandbox\n- Names: `sandbox.credentials`, `decode`, `maskClaims`, `awsPairs`, `sigv4`\n- Tier: Use it now\n- Useful: 3\/5\n- Signal: 4\/5"}