Configuration

Updated

Almost everything you configure in Bobbin is per endpoint, on the endpoint's Security settings page. There are no app-wide settings screens.

Per-endpoint settings

Open an endpoint and select Security settings. The page has two forms.

Replay destination

One URL that replays are sent to. The rules for what is accepted, and what happens when you change it, are in Replaying captures.

Retention and redaction

Select Save security settings after changing any of these.

Setting	Values	Default	Effect
Retention days	1 to 365	30	Captures older than this are deleted by the daily cleanup, along with their delivery history.
Headers to redact	Header names, separated by commas or new lines	None	The values of these headers are replaced with `[redacted by Bobbin]` before a capture is stored. Matching ignores case.
Redact request bodies	On or off	Off	The whole body is replaced with `[redacted by Bobbin]` before a capture is stored.

Redaction rules:

Redaction is applied when a request arrives. Changing the settings affects future captures only; captures already stored keep whatever they were stored with until retention removes them.
Body redaction is all or nothing. You cannot redact individual fields inside a body.
Each header name must be a valid HTTP header name. The Connection header cannot be redacted, because replays need it to work out which headers to strip.
Redacted values are replayed as the literal marker text, so redacting a header the destination depends on, such as a signature, makes replays of later captures fail that check.

Good candidates for redaction are Authorization, API key headers and cookies.

Lowering retention takes effect at the next daily cleanup: everything older than the new window is deleted then.

Scheduled jobs

Scalpels enables the Laravel Cloud scheduler for Bobbin. It runs two jobs:

Command	Schedule	What it does
`captures:prune`	Daily	Deletes captures older than each endpoint's retention window. It is the only thing that enforces retention.
`mcp-replays:redispatch`	Every minute	Re-queues any replay accepted through the MCP tools whose queue job has not started after 30 seconds.

If the scheduler is turned off, retention stops being enforced and captures accumulate. You can run the cleanup by hand from Laravel Cloud with php artisan captures:prune; it reports how many captures it removed.

Environment

Bobbin's manifest declares no environment keys, so Scalpels writes none and the install asks you for nothing. Laravel Cloud generates the application key and injects the database and queue settings when it attaches those resources. Leave those alone: setting your own database, cache, queue or filesystem variables shadows the injected ones and breaks the resource.

Bobbin reads one setting of its own, BOBBIN_ALLOW_PRIVATE_DESTINATIONS. It exists only for local development, where it lets replays reach localhost and private addresses, and it has no effect unless the app's environment is local. Never set it on a deployed installation.

Users

Bobbin has no screen for inviting or managing users. Add people as described in Getting started. Every user who belongs to Bobbin's team sees and can change every endpoint.