Skip to content
apikey.tools
Reference

API key formats & regex patterns

What credentials look like for 67 providers: the prefix to recognise, a regular expression that matches it, whether it is a live or test key, what an attacker can do with it, and where to revoke it. These are the same 95 signatures the API key detector and secret leak scanner run in your browser.

Updated

Airtable API key format

Airtable personal access token

high severity
Starts with
pat
Regex
pat[A-Za-z0-9]{14}\.[a-f0-9]{64}
Grants
Read and write the bases in the token's scope.
Revoke
airtable.com/create/tokens

Algolia API key format

Algolia admin API key

critical severity
Regex
(?:algolia).{0,30}(?:admin|api)_?key.{0,10}['"]([a-f0-9]{32})['"]
Grants
Delete and rewrite every search index on the application.
Revoke
Algolia dashboard → API Keys → regenerate.

AMQP credential format

AMQP broker URI with password

high severity
Starts with
amqps
Regex
amqps?://[^:@\s]+:[^@\s]{3,}@[^\s/]+
Grants
Publish and consume from every queue the user can access.
Revoke
Rotate the broker user's password and redeploy consumers.

Anthropic API key format

Anthropic API key

high severity
Starts with
sk-ant-api
Regex
sk-ant-api\d{2}-[A-Za-z0-9_-]{80,}
Grants
Spend against the organisation's credit balance via the Claude API.
Revoke
console.anthropic.com/settings/keys

Asana API key format

Asana personal access token

medium severity
Regex
[0-9]/[0-9]{16}:[a-f0-9]{32}
Grants
Read and modify the user's tasks and projects.
Revoke
app.asana.com/0/my-apps

Atlassian API key format

Auth0 API key format

Auth0 client secret

critical severity
Regex
(?:auth0).{0,30}(?:client_secret|secret).{0,10}['"]([A-Za-z0-9_-]{64})['"]
Grants
Mint tokens as your application, including via the client-credentials grant.
Revoke
Auth0 dashboard → Applications → rotate secret.

AWS API key format

AWS access key ID

critical severity
Regex
\b((?:AKIA|ASIA|ABIA|ACCA|A3T[A-Z0-9])[A-Z0-9]{16})\b
Grants
Identifies an IAM principal. On its own it is not a secret, but paired with a secret access key it inherits every permission that principal holds. ASIA marks a temporary STS credential.
Revoke
aws iam delete-access-key --access-key-id <id> — then review CloudTrail for the key's activity.

AWS secret access key

critical severity
Regex
(?:aws.{0,20})?(?:secret|access).{0,20}['"]([A-Za-z0-9/+=]{40})['"]
Grants
The secret half of an AWS credential pair. Combined with an access key ID it grants the full IAM permission set — often far more than intended.
Revoke
aws iam delete-access-key --access-key-id <id>

AWS session token

high severity
Regex
(?:aws_session_token|x-amz-security-token)\s*[=:]\s*['"]?([A-Za-z0-9/+=]{100,})
Grants
Temporary STS credential. Expires on its own, but until then carries the assumed role's permissions.
Revoke
Expires automatically. To cut it short, revoke the role's active sessions in IAM.

Azure API key format

Azure storage account key

critical severity
Regex
(?:AccountKey|storage.{0,20}key)\s*[=:]\s*['"]?([A-Za-z0-9+/]{86}==)
Grants
Read and write every blob, queue, table and file share in the storage account.
Revoke
az storage account keys renew --account-name <name> --key primary

Azure connection string

critical severity
Starts with
DefaultEndpointsProtocol=https
Regex
DefaultEndpointsProtocol=https?;AccountName=[^;]+;AccountKey=[^;]+
Grants
Complete access to the named storage account.
Revoke
az storage account keys renew --account-name <name> --key primary

Braintree API key format

Braintree production access token

critical severityLive / production
Starts with
access_token
Regex
access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32}
Grants
Full gateway access: transactions, vaulted payment methods and merchant configuration.
Revoke
Braintree Control Panel → Settings → API

Clerk API key format

Clerk secret key

critical severity
Starts with
sk_
Regex
sk_(?:live|test)_[A-Za-z0-9]{40,}
Grants
Backend API access: read and modify every user and session.
Revoke
Clerk dashboard → API Keys.

Cloudflare API key format

Cloudflare API token

high severity
Regex
(?:cloudflare|cf).{0,20}(?:token|key).{0,10}['"]([A-Za-z0-9_-]{40})['"]
Grants
DNS, WAF and cache control for the zones in the token's scope. DNS write access enables domain takeover.
Revoke
dash.cloudflare.com/profile/api-tokens

Cloudinary API key format

Cloudinary environment URL

high severity
Starts with
cloudinary://
Regex
cloudinary://[0-9]{12,20}:[A-Za-z0-9_-]{20,}@[a-z0-9_-]+
Grants
Upload, transform and delete every asset in the account.
Revoke
Cloudinary console → Settings → Security → regenerate API secret.

Datadog API key format

DigitalOcean API key format

DigitalOcean personal access token

critical severity
Starts with
dop_v1_
Regex
dop_v1_[a-f0-9]{64}
Grants
Create and destroy droplets, databases and Spaces buckets across the whole account.
Revoke
cloud.digitalocean.com/account/api/tokens

Discord API key format

Discord bot token

critical severity
Regex
[MNO][A-Za-z\d_-]{23,25}\.[\w-]{6}\.[\w-]{27,38}
Grants
Full control of the bot: read messages, manage members and delete channels in every guild it joined.
Revoke
discord.com/developers/applications → Bot → Reset Token.

Discord webhook URL

medium severity
Starts with
https://
Regex
https://(?:canary\.|ptb\.)?discord(?:app)?\.com/api/webhooks/[0-9]{17,20}/[A-Za-z0-9_-]{60,68}
Grants
Post messages into one channel as the webhook identity.
Revoke
Channel settings → Integrations → delete the webhook.

Docker Hub API key format

Docker Hub personal access token

high severity
Starts with
dckr_pat_
Regex
dckr_pat_[A-Za-z0-9_-]{27}
Grants
Pull private images and push to the account's repositories.
Revoke
hub.docker.com/settings/security

Doppler API key format

Doppler service token

critical severity
Starts with
dp.
Regex
dp\.(?:pt|st|sa|ct)\.[A-Za-z0-9]{40,44}
Grants
Reads the secrets in a Doppler config — every credential the application uses.
Revoke
dashboard.doppler.com → Access → revoke token.

Figma API key format

Figma personal access token

medium severity
Starts with
figd_
Regex
figd_[A-Za-z0-9_-]{40,}
Grants
Read the files and projects the user can access.
Revoke
Figma → Settings → Personal access tokens.

Firebase API key format

Firebase cloud Messaging server key

high severity
Starts with
AAAA
Regex
AAAA[A-Za-z0-9_-]{7}:[A-Za-z0-9_-]{140,}
Grants
Send push notifications to every device registered to the app.
Revoke
Firebase console → Project settings → Cloud Messaging.

Fly.io API key format

Fly.io deploy token

high severity
Regex
fm[12]_[A-Za-z0-9+/=]{40,}
Grants
Deploy and destroy applications, and read their secrets.
Revoke
fly tokens revoke <id>

GitHub API key format

GitHub classic personal access token

critical severity
Starts with
ghp_
Regex
ghp_[A-Za-z0-9]{36}
Grants
Every repository and organisation the user can reach, subject to the token's scopes. Classic tokens are notoriously over-scoped.
Revoke
github.com/settings/tokens — delete the token, then check the security log for its use.

GitHub fine-grained personal access token

critical severity
Starts with
github_pat_
Regex
github_pat_[A-Za-z0-9_]{82}
Grants
The specific repositories and permissions selected at creation.
Revoke
github.com/settings/tokens?type=beta

GitHub OAuth access token

critical severity
Starts with
gho_
Regex
gho_[A-Za-z0-9]{36}
Grants
Acts as the user who authorised the OAuth app.
Revoke
github.com/settings/applications

GitHub app installation token

high severity
Starts with
ghs_
Regex
ghs_[A-Za-z0-9]{36}
Grants
Acts as a GitHub App installation. Expires after one hour, which limits but does not eliminate the risk.
Revoke
Expires in ≤1 hour. Rotate the app's private key if the generator leaked too.

GitHub refresh token

critical severity
Starts with
ghr_
Regex
ghr_[A-Za-z0-9]{36}
Grants
Mints fresh access tokens indefinitely — worse than leaking an access token.
Revoke
github.com/settings/applications

GitLab API key format

GitLab personal access token

critical severity
Starts with
glpat-
Regex
glpat-[A-Za-z0-9_-]{20}
Grants
Repository and CI/CD access for the user, including protected variables if api scope is granted.
Revoke
gitlab.com/-/user_settings/personal_access_tokens

GitLab runner registration token

high severity
Starts with
GR1348941
Regex
GR1348941[A-Za-z0-9_-]{20}
Grants
Register a malicious CI runner that receives jobs — and every secret those jobs inject.
Revoke
Project or group → Settings → CI/CD → Runners → reset token.

Google Cloud API key format

Google Cloud API key

high severity
Starts with
AIza
Regex
AIza[0-9A-Za-z_-]{35}
Grants
Calls whichever Google APIs the key is enabled for. Unrestricted keys are billable and abusable; Maps keys are a common source of surprise invoices.
Revoke
console.cloud.google.com/apis/credentials — delete the key or add HTTP referrer and API restrictions.

Google Cloud OAuth client ID

low severity
Regex
[0-9]+-[0-9a-z_]{32}\.apps\.googleusercontent\.com
Grants
Public identifier for an OAuth client. Harmless alone; dangerous next to its client secret.
Revoke
Not secret. Verify the paired secret has not leaked with it.

Google Cloud service account key file

critical severity
Starts with
"type"
Regex
"type"\s*:\s*"service_account"
Grants
Full impersonation of a service account, including every IAM role bound to it. These JSON files never expire.
Revoke
gcloud iam service-accounts keys delete <key-id> --iam-account=<email>

Grafana API key format

Grafana cloud access policy token

high severity
Starts with
glc_
Regex
glc_[A-Za-z0-9+/=]{32,}
Grants
Write metrics and read dashboards in the Grafana Cloud stack.
Revoke
Grafana Cloud → Access Policies → revoke token.

Groq API key format

Groq API key

high severity
Starts with
gsk_
Regex
gsk_[A-Za-z0-9]{52}
Grants
Billable inference against the account.
Revoke
console.groq.com/keys

HashiCorp Vault API key format

HashiCorp Vault service token

critical severity
Regex
hv[sb]\.[A-Za-z0-9_-]{24,}
Grants
Reads every secret path the token's policies allow.
Revoke
vault token revoke <token>

HCP Terraform API key format

HCP Terraform API token

critical severity
Regex
[A-Za-z0-9]{14}\.atlasv1\.[A-Za-z0-9_-]{60,}
Grants
Read and modify Terraform state — which typically contains every secret your infrastructure uses.
Revoke
app.terraform.io/app/settings/tokens

Heroku API key format

Heroku API key

critical severity
Regex
(?:heroku).{0,20}['"]([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})['"]
Grants
Deploy, read config vars and delete applications across the account.
Revoke
heroku authorizations:revoke <id>

HubSpot API key format

HubSpot private app token

critical severity
Starts with
pat-
Regex
pat-(?:na|eu)[0-9]-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}
Grants
Read and export the entire CRM: contacts, deals and email history.
Revoke
HubSpot → Settings → Integrations → Private Apps.

Hugging Face API key format

Hugging Face user access token

high severity
Starts with
hf_
Regex
hf_[A-Za-z0-9]{34}
Grants
Read private models and datasets; write tokens can publish to the account's repos.
Revoke
huggingface.co/settings/tokens

Intercom API key format

Intercom access token

high severity
Starts with
dG9rOg
Regex
dG9rOg[A-Za-z0-9+/=]{40,}
Grants
Read and write customer conversations and contact records.
Revoke
Intercom → Settings → Developers → revoke.

Linear API key format

Linear API key

high severity
Starts with
lin_api_
Regex
lin_api_[A-Za-z0-9]{40}
Grants
Read and modify the workspace's issues and projects.
Revoke
Linear → Settings → API → revoke key.

Mailchimp API key format

Mailchimp API key

high severity
Regex
[a-f0-9]{32}-us[0-9]{1,2}
Grants
Read and export every audience list, and send campaigns.
Revoke
admin.mailchimp.com/account/api/

Mailgun API key format

Meta API key format

MongoDB credential format

MongoDB connection URI with password

critical severity
Starts with
mongodb
Regex
mongodb(?:\+srv)?://[^:@\s]+:[^@\s]{3,}@[^\s/]+
Grants
Full access to the cluster's databases and collections.
Revoke
Atlas → Database Access → edit user password, then update the connection string everywhere.

MySQL credential format

MySQL connection URI with password

critical severity
Starts with
mysql://
Regex
mysql://[^:@\s]+:[^@\s]{3,}@[^\s/]+
Grants
Direct database access with the role's privileges.
Revoke
ALTER USER '<user>'@'%' IDENTIFIED BY '<new>'; FLUSH PRIVILEGES;

New Relic API key format

New Relic user API key

high severity
Starts with
NRAK-
Regex
NRAK-[A-Z0-9]{27}
Grants
Query telemetry and modify alerting across the account.
Revoke
one.newrelic.com/api-keys

Notion API key format

Notion integration token

high severity
Regex
(?:secret_|ntn_)[A-Za-z0-9]{36,50}
Grants
Read and write every page shared with the integration.
Revoke
www.notion.so/my-integrations

npm API key format

npm access token

critical severity
Starts with
npm_
Regex
npm_[A-Za-z0-9]{36}
Grants
Publish packages under the account's scopes — a direct supply-chain compromise vector.
Revoke
npm token revoke <id>

Okta API key format

Okta API token

critical severity
Regex
00[A-Za-z0-9_-]{40}
Grants
Administer the identity provider: create users, reset factors and grant admin roles. This is a full-tenant compromise.
Revoke
Okta admin → Security → API → Tokens → revoke.

OpenAI API key format

OpenAI project API key

high severity
Starts with
sk-proj-
Regex
sk-proj-[A-Za-z0-9_-]{40,}
Grants
Spend against the project's billing quota and read its stored files and assistants.
Revoke
platform.openai.com/api-keys

OpenAI legacy API key

high severity
Starts with
sk-
Regex
sk-[A-Za-z0-9]{48}
Grants
Full API access billed to the organisation.
Revoke
platform.openai.com/api-keys

OpenSSH credential format

OpenSSH private key

critical severity
Starts with
-----BEGIN OPENSSH PRIVATE KEY-----
Regex
-----BEGIN OPENSSH PRIVATE KEY-----
Grants
SSH access as the key's owner to every host trusting it.
Revoke
Remove the public key from all authorized_keys files, then generate a replacement.

PayPal API key format

Perplexity API key format

PGP credential format

PGP private key block

critical severity
Starts with
-----BEGIN PGP PRIVATE KEY BLOCK-----
Regex
-----BEGIN PGP PRIVATE KEY BLOCK-----
Grants
Sign and decrypt as the key's identity.
Revoke
Publish a revocation certificate and generate a new key.

PostgreSQL credential format

PostgreSQL connection URI with password

critical severity
Starts with
postgres
Regex
postgres(?:ql)?://[^:@\s]+:[^@\s]{3,}@[^\s/]+
Grants
Direct database access. Read, modify or drop everything the role can reach.
Revoke
ALTER ROLE <user> WITH PASSWORD '<new>'; then restrict pg_hba.conf and rotate app config.

Postman API key format

Postman API key

high severity
Starts with
PMAK-
Regex
PMAK-[a-f0-9]{24}-[a-f0-9]{34}
Grants
Read every collection and environment in the workspace — which routinely contain other teams' secrets.
Revoke
go.postman.co/settings/me/api-keys

Postmark API key format

Postmark server token

high severity
Regex
(?:postmark).{0,20}['"]([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})['"]
Grants
Send transactional mail from the server and read its message history.
Revoke
Postmark → Servers → API Tokens.

PyPI API key format

PyPI upload token

critical severity
Starts with
pypi-AgEIcHlwaS5vcmc
Regex
pypi-AgEIcHlwaS5vcmc[A-Za-z0-9_-]{50,}
Grants
Publish releases for the projects in the token's scope.
Revoke
pypi.org/manage/account/token/

Redis credential format

Redis connection URI with password

high severity
Starts with
redis
Regex
redis(?:s)?://[^:@\s]*:[^@\s]{3,}@[^\s/]+
Grants
Read and flush the cache — which often holds session tokens.
Revoke
Rotate requirepass or the managed instance's credentials.

Replicate API key format

Resend API key format

Resend API key

high severity
Starts with
re_
Regex
re_[A-Za-z0-9_]{20,}
Grants
Send mail from your verified domains.
Revoke
resend.com/api-keys

RubyGems API key format

RubyGems API key

critical severity
Starts with
rubygems_
Regex
rubygems_[a-f0-9]{48}
Grants
Push and yank gems owned by the account.
Revoke
rubygems.org/settings/edit

SendGrid API key format

SendGrid API key

critical severity
Starts with
SG.
Regex
SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}
Grants
Send mail from your verified domains — ideal for phishing that passes SPF and DKIM.
Revoke
app.sendgrid.com/settings/api_keys

Sentry API key format

Sentry auth token

high severity
Regex
(?:sntrys_|sntryu_)[A-Za-z0-9+/=_]{40,}
Grants
Read error events — which frequently contain request bodies, headers and other secrets.
Revoke
sentry.io/settings/account/api/auth-tokens/

Shopify API key format

Shopify admin API access token

critical severity
Starts with
shpat_
Regex
shpat_[a-fA-F0-9]{32}
Grants
Admin API access to a storefront: orders, customers, products and payouts, limited by the app's scopes.
Revoke
Shopify admin → Apps → uninstall or rotate the app's credentials.

Shopify app shared secret

high severity
Starts with
shpss_
Regex
shpss_[a-fA-F0-9]{32}
Grants
Forge webhook signatures and OAuth callbacks for your app.
Revoke
Shopify Partner dashboard → App setup → rotate secret.

Slack API key format

Slack bot token

critical severity
Starts with
xoxb-
Regex
xoxb-[0-9]{10,14}-[0-9]{10,14}-[A-Za-z0-9]{24,34}
Grants
Read and post in every channel the bot has joined, and read the user directory.
Revoke
api.slack.com/apps → OAuth & Permissions → revoke and reinstall.

Slack user token

critical severity
Starts with
xoxp-
Regex
xoxp-[0-9]{10,14}-[0-9]{10,14}-[0-9]{10,14}-[a-f0-9]{32}
Grants
Acts as the user — reads their DMs and private channels.
Revoke
api.slack.com/apps → revoke tokens.

Slack app-level token

high severity
Starts with
xapp-
Regex
xapp-[0-9]-[A-Z0-9]+-[0-9]+-[a-f0-9]{64}
Grants
Opens Socket Mode connections and receives the app's events.
Revoke
api.slack.com/apps → Basic Information → App-Level Tokens.

Slack incoming webhook URL

medium severity
Starts with
https://hooks.slack.com/services/T
Regex
https://hooks\.slack\.com/services/T[A-Za-z0-9_]{8,}/B[A-Za-z0-9_]{8,}/[A-Za-z0-9_]{24}
Grants
Post messages into one specific channel. Used for convincing internal phishing.
Revoke
api.slack.com/apps → Incoming Webhooks → delete the URL.

Snyk API key format

Snyk API token

medium severity
Regex
(?:snyk).{0,20}(?:token|key).{0,10}['"]([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})['"]
Grants
Read the organisation's dependency and vulnerability inventory — a map of what to attack.
Revoke
app.snyk.io/account

Square API key format

Square production access token

critical severityLive / production
Starts with
sq0atp-
Regex
sq0atp-[0-9A-Za-z_-]{22}
Grants
Payments, refunds and customer data for the merchant account.
Revoke
developer.squareup.com/apps

Square OAuth client secret

critical severity
Starts with
sq0csp-
Regex
sq0csp-[0-9A-Za-z_-]{43}
Grants
Impersonate your application during OAuth, obtaining tokens for any merchant who authorises it.
Revoke
developer.squareup.com/apps

Stripe API key format

Stripe live secret key

critical severityLive / production
Starts with
sk_live_
Regex
sk_live_[0-9a-zA-Z]{24,247}
Grants
Full API access to a live account: charge cards, issue refunds, read every customer record, and change payout destinations.
Revoke
dashboard.stripe.com/apikeys — roll the key, then audit recent charges and payouts.

Stripe live restricted key

high severityLive / production
Starts with
rk_live_
Regex
rk_live_[0-9a-zA-Z]{24,247}
Grants
Scoped live access — whatever resources the key was granted when created.
Revoke
dashboard.stripe.com/apikeys

Stripe test secret key

low severityTest / sandbox
Starts with
sk_test_
Regex
sk_test_[0-9a-zA-Z]{24,247}
Grants
Sandbox only — no real money moves. Still worth rotating: it reveals account structure.
Revoke
dashboard.stripe.com/test/apikeys

Stripe publishable key

low severity
Starts with
pk_
Regex
pk_(live|test)_[0-9a-zA-Z]{24,247}
Grants
Designed to be public. It can only tokenise payment details, not read or move money.
Revoke
No action needed — publishable keys belong in client code.

Stripe webhook signing secret

high severity
Starts with
whsec_
Regex
whsec_[a-zA-Z0-9]{32,64}
Grants
Lets an attacker forge webhook events your system will treat as authentic — fake payment successes, for example.
Revoke
dashboard.stripe.com/webhooks — roll the endpoint secret.

Supabase API key format

Supabase service role key

critical severity
Regex
(?:service_role|SUPABASE_SERVICE_ROLE_KEY)\s*[=:]\s*['"]?(eyJ[A-Za-z0-9_-]{20,})
Grants
Bypasses every row-level security policy. Full read and write over the database.
Revoke
Supabase → Project Settings → API → rotate service role key.

Telegram API key format

Telegram bot token

high severity
Regex
\b[0-9]{8,10}:[A-Za-z0-9_-]{35}\b
Grants
Full control of the bot, including reading every message sent to it.
Revoke
Message @BotFather → /revoke.

Twilio API key format

Twilio auth token

critical severity
Regex
(?:twilio).{0,20}['"]([a-f0-9]{32})['"]
Grants
Send SMS and place calls billed to the account, and read message history.
Revoke
console.twilio.com — rotate the auth token.

X (Twitter) API key format

X (Twitter) bearer token

high severity
Starts with
AAAAAAAAAAAAAAAAAAAAA
Regex
AAAAAAAAAAAAAAAAAAAAA[A-Za-z0-9%]{50,}
Grants
App-only API access, billed against the project's quota.
Revoke
developer.x.com/en/portal/dashboard — regenerate.

Generic secrets & private keys

Credentials embedded in a URL

high severity
Regex
[a-z][a-z0-9+.-]{1,20}://[^/\s:@]{3,}:[^/\s:@]{3,}@[^\s]+
Grants
Whatever the embedded credential grants. URLs leak into logs, Referer headers and browser history.
Revoke
Rotate the credential and move it to a header or environment variable.

RSA private key

critical severity
Starts with
-----BEGIN RSA PRIVATE KEY-----
Regex
-----BEGIN RSA PRIVATE KEY-----
Grants
Impersonate whatever the key authenticates: a TLS server, a signing identity, an SSH account.
Revoke
Generate a new key pair, redeploy the public half, and revoke the old certificate.

PKCS#8 private key

critical severity
Starts with
-----BEGIN
Regex
-----BEGIN (?:ENCRYPTED )?PRIVATE KEY-----
Grants
Signing or decryption as the key's identity.
Revoke
Rotate the key pair and revoke any certificate issued for it.

EC private key

critical severity
Starts with
-----BEGIN EC PRIVATE KEY-----
Regex
-----BEGIN EC PRIVATE KEY-----
Grants
Signing as the key's identity.
Revoke
Rotate the key pair.

JSON Web Token

medium severity
Starts with
eyJ
Regex
eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}
Grants
Depends on the claims. Decode it to see the audience, scope and expiry — an unexpired token with broad scope is a live credential.
Revoke
Cannot be revoked before exp unless the issuer maintains a denylist. Rotate the signing key to invalidate all tokens.

Hardcoded secret assignment

medium severity
Regex
(?:api[_-]?key|apikey|secret|token|passwo?r?d|passwd|auth|credential|private[_-]?key)\s*[:=]\s*['"]([^'"\s]{8,})['"]
Grants
A literal credential in source. Even if the value is a placeholder today, the pattern is how real keys get committed.
Revoke
Move it to an environment variable or secrets manager, then rotate the value.

High-entropy hex string

low severity
Regex
\b[a-f0-9]{40,}\b
Grants
Might be a key, might be a commit SHA or a checksum. Judge it by what surrounds it.
Revoke
Identify the value before acting.

Frequently asked questions

How can I tell which service an API key belongs to?

Most modern keys start with a vendor prefix: sk_live_ and rk_live_ for Stripe, sk-proj- for OpenAI, sk-ant- for Anthropic, ghp_ for GitHub, xoxb- for Slack bots, AKIA for AWS access key IDs and AIza for Google API keys. Match the prefix and length against the table on this page, or paste the key into the API key detector, which runs the same patterns locally in your browser.

What is the regex for an AWS access key?

Long-term AWS access key IDs match AKIA followed by 16 uppercase letters and digits, and temporary ones from STS start with ASIA. The matching secret access key is 40 characters of Base64-like text with no prefix, so it cannot be reliably detected by format alone — scanners look for it near an access key ID or a variable name such as aws_secret_access_key.

Why do API keys have prefixes?

A prefix adds no security, but it makes a key recognisable. Engineers can tell a live key from a test key at a glance, log scrubbers can redact it, and secret scanners such as GitHub's can detect a leaked key with very few false positives and notify the provider. If you issue your own keys, give them a distinctive prefix.

Can a regex tell me whether a key is valid?

No. A pattern only tells you that a string has the shape of a given credential. Whether the key is active can only be confirmed by the provider. These patterns are for detection and classification — finding keys in code, logs and pastes — not for validation.

Put these patterns to work

Identify a single key, scan a whole file, or test your own detector.