credentials: add hash

Author: adtac

credentials.mdx

@@ -31,3 +31,36 @@ This option affects the following HTTP headers across all requests:
 - `Cookie` header on the request
 - `Set-Cookie` header on the response
 - `Authorization` header on the response
+
+The following values are allowed:
+
+- `redact` will redact the auth credential completely (default).
+- `hash` will replace the value with a SHA256 hash of the original value (see below).
+- `keep` will trace the full auth credential string in cleartext (NOT recommended).
+
+## Using `authCredential: "hash"`
+
+The `authCredential: "hash"` allows you to cross-match credentials across
+different requests safely without storing raw auth credentials in cleartext.
+For example, let's say a client makes an API call with following request
+header:
+
+
+```
+Authorization: Bearer my-secret-api-key-1234
+```
+
+Setting `authCredential: "hash"` will hash the value when the request is traced:
+
+```
+Authorization: <redacted:sha256:a4281572876fbe0eb4780386c435bd8be7bc36136a98e90a68a0af3837f27483>
+```
+
+Two requests using the same `Authorization` header will have the same redacted
+hash. If you know the original API key, you can also compute the hash yourself
+using the `sha256sum` command:
+
+```
+$ echo -n "Bearer my-secret-api-key-1234" | sha256sum
+a4281572876fbe0eb4780386c435bd8be7bc36136a98e90a68a0af3837f27483  -
+```