# How to Share Screenshots With AI Tools Without Leaking API Keys > Terminal and config screenshots often show API keys. How to crop and cover them on a Mac before pasting into an AI coding tool, and what to do if one leaks. By Ahmed Gagan, Snugbits. Published 2026-11-09. https://snugbits.com/blog/vibeshots/share-screenshots-ai-without-leaking-api-keys About: [Vibeshots](https://snugbits.com/vibeshots.md), Screenshots that blur your secrets. The safest way to share a screenshot with Cursor, Claude Code, Codex or ChatGPT is to capture only the part of the screen you need, then cover anything that looks like a key with a solid box before you paste it. On a Mac you can do both with the built-in screenshot tool and Markup. If a key has already gone out in a screenshot, rotate it: revoke the old key and make a new one. Below are the manual steps, why each one matters, and a faster way if you send screenshots all day. ## Why screenshots leak keys When something breaks, the quickest thing to show an AI tool is the screen: the terminal with the error, the config file, the dashboard. Those are exactly the places keys live. A `.env` file open in a split pane, an `export OPENAI_API_KEY=...` a few lines up in your shell history, a `curl` command with an `Authorization: Bearer` header. You're looking at the error, so you don't notice the key. Once the image is pasted into a chat, it has left your Mac. You can delete the message, but you can't be sure where the picture went or how long it's kept. So the work has to happen before you paste. ## Step 1: Capture less of the screen A full-screen capture shows everything. A tight one shows only the error. Apple's [screenshot guide](https://support.apple.com/en-us/102646) lists the shortcuts: | Shortcut | What it captures | | --- | --- | | ⇧⌘3 | The whole screen | | ⇧⌘4 | An area you drag out. Press Space after it to capture a single window or menu instead | | ⇧⌘5 | Opens the Screenshot app with all the options | Add Control to any of them (for example ⌃⇧⌘4) and the screenshot goes to the clipboard instead of a file, ready to paste. Press Esc to cancel a capture. The **Options** menu in ⇧⌘5 lets you: - Choose where screenshots are saved - Set a timer - Show or hide the floating thumbnail after a capture - Show or hide the mouse pointer - On supported Macs running macOS Tahoe 26 or later, pick the capture format: SDR (PNG) or HDR (HEIF) For sharing with AI tools, ⌃⇧⌘4 is the one to learn. Drag around just the error text, and the key three lines above it never makes it into the picture. ### Tidy up before you capture A few seconds of prep removes most of the risk: - Close or collapse the `.env` file, or switch to another tab. - In the terminal, run `clear` so old output scrolls out of view. - Hide browser tabs or bookmarks that show account names. ```sh clear ``` ## Step 2: Cover anything sensitive with Markup When the key has to be in the frame, cover it. Markup is built into macOS, and Apple's [Markup guide](https://support.apple.com/guide/mac-help/mchl1fd88863/mac) describes the tools. 1. Take the screenshot with the floating thumbnail switched on, then click the thumbnail to edit the screenshot. (You can also open any image in Preview, or select it in Finder, press Space for Quick Look and click the Markup button.) 2. Click **Shapes** and choose the rectangle. 3. Drag the rectangle over the key. 4. Click **Fill Color** and choose a solid colour, such as black. Set **Border Color** to match. 5. Click **Done** to save. Use a filled shape, not the **Highlight** tool. A highlight is see-through, so the key is still readable under it. Then check the result. Open the saved file again and zoom in on where the key was. If you can still read any part of it, cover it again. ### What this way can't do - It relies on you spotting the key. In a long log or a dense config, it's easy to miss one. - It takes a minute per screenshot. When you're sending five shots to an agent to explain a bug, that adds up. - Long tokens wrap across lines, so one secret can need two or three boxes. ## Step 3: If a key leaked, rotate it If a screenshot with a readable key has already been pasted somewhere, treat the key as exposed. Deleting the message doesn't change that. 1. Sign in to the service that issued the key (your AI provider, cloud host, payment provider or Git host). 2. Create a new key. 3. Put the new key wherever the old one was used: your `.env` file, your deployment's environment variables, your CI secrets. 4. Revoke or delete the old key. 5. Check the service's usage or audit log for activity you don't recognise. Doing steps 2 and 3 before step 4 means your app keeps working while you swap. If you think the key is already being misused, revoke it first and fix the app afterwards. ## The faster way: Vibeshots [Vibeshots](/vibeshots) is a menu bar screenshot app made for this kind of work. Every capture goes straight to the clipboard and into a searchable history, and its shortcuts start with ⌃⌥⌘ so they stay clear of ⇧⌘4 and your editor. The part that matters here is **auto-blur**. Switch it on in **Settings › Capture**, and Vibeshots reads the text in each capture on your Mac and pixelates anything that looks like a key before it reaches the clipboard. It knows the shapes of OpenAI, Anthropic, AWS, GitHub, Google, Slack and Stripe keys, JSON Web Tokens, bearer tokens, private key headers, lines like `password=…` or `api_key: …`, and very long token-like strings. The blur is flattened into the image, so there's no layer to peel back. It's off until you turn it on, and like any detector it can't catch everything, so give sensitive shots a quick look. For what a pattern can't spot, the editor has a blur brush, plus arrows, boxes, text and a highlighter to point at the problem. Press ⌃⌥⌘V where you're typing and the paste panel drops several recent captures into Cursor, Claude Code, Codex or ChatGPT in one go. Terminal agents that take images with Ctrl+V work too, since every capture is already on the clipboard. Capturing, text recognition and blurring all run on your Mac. There's no account, and the app goes online only to activate your license and check for updates. It runs on macOS 14 Sonoma or later, on Apple silicon and Intel. A lifetime license is $17.99 for one Mac, $44.99 for three, $69.99 for five or $269.99 for twenty. ## FAQ ### Can AI tools read API keys in screenshots? Yes. Tools that accept images can read the text in them, keys included. If a key is legible to you, assume the tool can read it too. ### How do I take a screenshot straight to the clipboard on a Mac? Add Control to the usual shortcut. ⌃⇧⌘4 lets you drag out an area and copies it to the clipboard instead of saving a file, and ⌃⇧⌘3 does the same for the whole screen. ### Is the Highlight tool in Markup enough to hide a key? No. Highlight is see-through, so the text underneath stays readable. Use a rectangle from Shapes with a solid Fill Color, then reopen the saved file to check. ### What should I do if I already pasted a screenshot with my API key? Rotate the key. Create a new one in the provider's dashboard, update your app and environment variables, revoke the old key, and check the usage log for anything unfamiliar. ### Is Vibeshots' auto-blur on by default? No. Turn it on once in Settings › Capture, and from then on every capture is checked before it reaches the clipboard. You can also run it on a single screenshot from the editor.