About this tool
You found a key in a log file, an old dotfile, a chat message or a public repository — but whose key is it, and how bad is the leak? API Key Identifier answers both questions with one paste. It matches the pasted string against a library of more than fifteen well-known credential formats: OpenAI sk- and sk-proj-, Anthropic sk-ant-, GitHub personal access tokens ghp_ and fine-grained github_pat_, OAuth tokens gho_, AWS access key IDs starting AKIA or ASIA, Slack bot and user tokens xoxb- and xoxp-, Stripe live and test secret keys plus webhook secrets whsec_, Google API keys AIza, Shopify access tokens shpat_, Twilio, SendGrid, npm, PyPI, DigitalOcean, Square and more. Each match reports the provider, the credential type and whether it looks like a live or test secret. If a key is recognized, the tool shows an emergency checklist: revoke or rotate it at the provider immediately, audit recent usage logs, scrub it from git history and add secret scanning to CI. Matching happens with plain regular expressions in your browser, so the key itself is never transmitted anywhere — which matters, because the whole point is that it has already been exposed once.
How to use API Key Identifier
- Paste the suspicious string into the input — it is matched locally and never sent anywhere.
- Read the identified provider, credential type and whether it is a live or test key.
- If it is a real secret, follow the leak-response checklist: revoke first, investigate second.
- If nothing matches, the string may be an internal token — treat it as live until proven otherwise.
Frequently asked questions
Does the key leave my browser?
No. Identification is pure pattern matching done locally in JavaScript. Nothing is sent to any server, which is essential when handling possibly-live credentials.
The key matched nothing — is it safe?
Not necessarily. The library covers the most common public formats, but private or internal tokens have no standard prefix. Treat any unrecognized secret as live until you can prove otherwise.
A key was committed to git. Is deleting the commit enough?
No. Rotate the key first — assume it was harvested the moment it was pushed, especially to a public repo. Then scrub history with git filter-repo or BFG and force-push.
Why do some matches say 'live' or 'test'?
Providers like Stripe encode the environment in the prefix (sk_live_ vs sk_test_). Test keys are lower risk but still reveal your account structure and should not be shared.