> For the complete documentation index, see [llms.txt](https://doc.wearepatchworks.com/product-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.wearepatchworks.com/product-documentation/general-settings/debug-mode.md).

# Debug mode

## Introduction

To protect sensitive data, Patchworks redacts header credentials and other secret values in flow run logs by default. Access tokens, authorisation headers, and request payload content containing secrets are masked, so they can't be read by anyone reviewing a run.

**Debug mode** is a company-level setting that lets an admin temporarily display these values in full - useful when you're troubleshooting authentication issues and need to confirm exactly what's being sent.

{% hint style="info" %}
**Requires admin access.** Debug mode is managed from the **Company Admin** page, so only users with an admin role can change it.
{% endhint %}

### How redaction works

With Debug mode **off** (the default), sensitive values in flow run logs are replaced with a redaction placeholder wherever they appear - for example, in the **Requests** and **Responses** tabs of the [run details panel](https://doc.wearepatchworks.com/product-documentation/process-flows/error-reporting-and-exception-handling/run-logs-and-queue/working-with-run-logs/viewing-logs):

```
X-Shopify-Access-Token : [ "[redacted len=38 sha256=a7a4c2ab27ceaf11]" ]
```

The placeholder tells you about the value without revealing it:

| Element  | Meaning                                                |
| -------- | ------------------------------------------------------ |
| `len`    | The character length of the original value.            |
| `sha256` | A truncated SHA-256 fingerprint of the original value. |

Redaction applies to credentials and other secret data wherever they appear in request/response details - including authentication headers (e.g. `Authorization`, `X-Shopify-Access-Token`) and request bodies containing secret values.

{% hint style="success" %}
You can often troubleshoot without exposing anything: the placeholder confirms a credential is present and is the expected length, and two redacted values with the same `sha256` fingerprint are the same value. If a flow is sending the wrong token, comparing fingerprints will usually tell you - with no need to enable Debug mode at all.
{% endhint %}

### Enabling Debug mode

<div data-with-frame="true"><figure><img src="https://2440044887-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLYNcUBVQwSkOMG6KjZfz%2Fuploads%2FrG33qFPWZkIX7seTvPrM%2FScreenshot%202026-10-08%20at%2011.20.20.png?alt=media&amp;token=44b56480-73da-4deb-83ed-f140b9ae7ed3" alt=""><figcaption></figcaption></figure></div>

* Go to **Settings** in the left-hand navigation and select **Company Admin**.
* Scroll to the **Log settings** section.
* Toggle **Debug mode** on.
* **Save.**

While enabled, credentials and other secret data are shown in full in this company's flow run logs. Toggle it off to return to redacted logs.

| Behaviour           | Detail                                                                                                   |
| ------------------- | -------------------------------------------------------------------------------------------------------- |
| Default             | Off - all headers and body requests with sensitive values are redacted.                                  |
| Scope               | Company-wide. Applies to all flow run logs for this company - it's not a per-flow or per-user setting.   |
| Who sees the effect | Everyone with access to this company's flow run logs.                                                    |
| Applies to          | Runs logged and Canvas logs while Debug mode is enabled. Logs captured while it was off remain redacted. |

<div data-with-frame="true"><figure><img src="https://2440044887-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLYNcUBVQwSkOMG6KjZfz%2Fuploads%2FunpO066Gu2oj2g3hVt19%2FScreenshot%202026-10-08%20at%2011.30.52.png?alt=media&amp;token=60b13a3c-f0b3-41f6-8665-d3a46f5e8200" alt=""><figcaption></figcaption></figure></div>

### Security considerations

{% hint style="warning" icon="triangle-exclamation" %}
Debug mode exposes live credentials. While it's enabled, **anyone with access to this company's flow run logs can see secrets in full** - and those values are also included in any run logs [downloaded](https://doc.wearepatchworks.com/product-documentation/process-flows/error-reporting-and-exception-handling/run-logs-and-queue/working-with-run-logs/downloading-run-logs) while it's on.
{% endhint %}

* Only enable Debug mode for as long as you need it, then turn it off.
* Avoid sharing run logs captured in Debug mode (e.g. attaching them to support tickets) - or rotate any credentials they contain if you do.
* For routine investigation, the redaction placeholder (`len` + `sha256`) is usually enough - reach for Debug mode only when you need the actual value.