Wrap anything that must not appear in the replay in ORSanitizedView. The region is blurred and hatched in the recording, matching the iOS SDK, and the widget deregisters itself as soon as it leaves the tree.

import 'package:openreplay/openreplay.dart';

ORSanitizedView(
  child: TextField(
    controller: _cardNumber,
    decoration: const InputDecoration(labelText: 'Card number'),
  ),
)

Masking is applied as a second raster pass over the captured frame, so it never changes what your user sees on screen.

Platform views — WebViews, maps, camera previews — render in separate native layers that Flutter cannot read back, so they would otherwise appear as blank regions. The tracker covers them with a placeholder by default. Opt out with maskPlatformViews: false:

await OpenReplay.instance.start(
  projectKey: 'YOUR_PROJECT_KEY',
  options: const OROptions(maskPlatformViews: false),
);

Bodies are dropped unless you set capturePayload: true, and cookie, set-cookie and authorization headers are dropped by default. Beyond that, sanitizer has the last say over every captured call:

OpenReplay.instance.patchNetwork(ORNetworkOptions(
  capturePayload: true,
  ignoreHeaders: ['cookie', 'set-cookie', 'authorization', 'x-api-key'],
  sanitizer: (record) {
    final body = record.requestBody;
    if (body is Map) body.remove('password');
    return record; // return null to drop the call entirely
  },
));

See network options for the full list of fields.

If you have any questions about this process, feel free to reach out to us on our Slack or check out our Forum.