Credentials is what happens to credential headers the sandbox sent, such as Authorization and Cookie: "strip" (the default) removes them, "redact" keeps each with its value replaced by "redacted" (after an auth scheme such as "Bearer "), and "keep" forwards them unchanged.
