Configuration

Bruno AI is available from v4.0.0 and higher.

How to enable Bruno AI

1. Open Preferences from the bottom-left corner of the app
2. Go to the AI section and click the Enable button.

The AI tab has three sections: Configuration, Autocomplete, and Security.

---

Configuration

Enable AI Features

Toggle AI Features on at the top of the Configuration tab.

Bruno never stores your API keys.

The keys stay on your machine and are not written to collections or Git. Bruno saves them locally in the same application-data folder as preferences.json, and they never leave your machine except when Bruno talks to the provider you configured.

• macOS: ~/Library/Application Support/bruno/
• Windows: %APPDATA%\bruno\
• Linux: ~/.config/bruno/

Add a provider

Choose the provider you want to connect:

• OpenAI - add an OpenAI API key and select OpenAI models
• Anthropic - add an Anthropic API key and select Claude models
• Custom AI providers - connect an OpenAI-compatible hosted or local endpoint

Each provider page includes setup, connection testing, model selection, and troubleshooting details.

---

Autocomplete

Enable Autocomplete

Toggle Inline Autocomplete on to activate ghost-text suggestions in script and test editors.

Model

Select which model handles suggestions. Auto (fastest available) picks the lightest model from your active providers and is recommended for keeping suggestions fast.

Trigger mode

Mode	Behavior
Aggressive	Suggests on every keystroke
Debounced	Suggests after you pause typing (default)
Manual	Only suggests when you press ⌘ \

Keymap

Key	Action
Tab	Accept the full suggestion
⌘ →	Accept one word at a time
Esc	Dismiss the suggestion
⌘ \	Trigger manually

---

Security

Bruno automatically redacts sensitive data before sending context to any provider. All protections are on by default.

Redact sensitive header values

Masks Authorization, cookies, API keys, and other credential-bearing headers. Non-sensitive headers pass through unchanged.

Request headers sent to Bruno:

Authorization: Bearer eyJhbGci...
Content-Type: application/json
X-Request-Id: req_abc123

What the AI receives:

Authorization: <redacted>
Content-Type: application/json
X-Request-Id: req_abc123

Redact sensitive body keys

Masks values under keys like password, *_token, and secret in JSON and GraphQL variables. Structure and non-sensitive fields still pass through.

Request body sent to Bruno:

{
  "username": "usebruno",
  "password": "mypassword",
  "access_token": "abc123",
  "email": "[e-mail]"
}

What the AI receives:

{
  "username": "usebruno",
  "password": "<redacted>",
  "access_token": "<redacted>",
  "email": "[e-mail]"
}

Redact response values

Sends the response as a shape only. Real values are replaced with type placeholders. Turn this off to send the actual response body.

Actual response:

{
  "id": 42,
  "name": "usebruno",
  "token": "eyJhbGci..."
}

What the AI receives:

{
  "id": "<number>",
  "name": "<string>",
  "token": "<string>"
}

Redact secret variable values

Masks values of variables whose names look like secrets. Variables explicitly marked secret are always redacted regardless of this toggle.

Environment variables:

baseUrl = https://api.example.com
api_key = sk-abc123

What the AI receives:

baseUrl = https://api.example.com
api_key = <redacted>

Custom redacted headers

Add header names to always mask on top of the built-in list. Matching is exact and case-insensitive.

Custom redacted variables

Add variable names whose values should always be masked when Bruno sends context to the model.

Covered by default

Authorization, Proxy-Authorization, Cookie, Set-Cookie, X-API-Key, X-Auth-Token, X-Access-Token, X-CSRF-Token, plus any name matching token, secret, password, or api_key.