Stripe popularised sk_live_. GitHub followed with ghp_. The convention spread because a prefixed key solves three real operational problems at once, for the price of eight extra characters.
What a prefix buys you
Scanners can match it. A regex for sk_live_[0-9a-zA-Z]{24,} is high-confidence: it will not fire on a commit SHA, a UUID or a base64 blob. Without a prefix, the only pattern available is "a long random-looking string", which produces so many false positives that people switch the scanner off. GitHub's own secret scanning works because vendors register distinctive prefixes.
Humans can triage it. An engineer looking at sk_live_… in a log knows immediately which system it belongs to and that it is a production credential. 4eC39HqLyjWDarjt tells them nothing, and the triage takes an hour instead of a second.
Environments stay separate. sk_live_ next to sk_test_ makes the most common production incident — a test key deployed to production, or worse, the reverse — visible on sight rather than at 3am.
The convention
Read left to right, each segment narrows the meaning:
sk/pk/rk— secret, publishable, or restricted. Says whether the key may appear in client code.live/test— the environment.- A trailing underscore before the random body, so the body can be split off with a single
split('_').pop().
Some vendors add a checksum to the body — GitHub appends a base62-encoded CRC32 to its tokens, so a scanner can reject a random string that merely looks like a token. That requires cooperation between the issuer and the checker, so it is worth doing only if you also control the detection side.
Keep the entropy in the body
The prefix is public and contributes zero entropy. If your key is sk_live_ plus 128 bits, its strength is 128 bits, not more. The readouts on this page measure only the random portion, which is the honest number.
Length budgeting
Prefixed keys end up long. A sk_live_ prefix plus 256 bits of Base58 is around 52 characters, which is fine in a header and awkward in a URL query parameter — though a key should never be in a query parameter anyway. If you need something shorter, drop to 128 bits of entropy before you drop the prefix; the prefix earns its length and the extra 128 bits do not.
Frequently asked questions
Does a prefix make my key easier to attack?
No. It tells an attacker which service the key belongs to, which they usually already know from where they found it. The random body still has to be guessed in full. The detection benefit vastly outweighs the disclosure.
Should the environment be in the prefix or in the key's metadata?
Both. Metadata is authoritative, but the prefix is what a human sees in a stack trace and what a scanner matches. Encoding it twice costs nothing and catches mistakes earlier.
What about publishable keys that ship in browser code?
Give them a visibly different prefix — pk_ rather than sk_ — so nobody has to check a dashboard to know whether a key in a bundle is a problem. The key vendor detector uses exactly this distinction to classify pasted keys.
Can I change the prefix on existing keys?
Not in place — the prefix is part of the key. Issue new keys with the new prefix, run both formats during an overlap window, then revoke the old ones. The rotation planner lays out that sequence.