About secret scanning patterns
There are three types of secret scanning alerts:
- User alerts: Reported to users in the Security tab of the repository, when a supported secret is detected in the repository.
- Push protection alerts: Reported to users in the Security tab of the repository, when a contributor bypasses push protection.
- Partner alerts: Reported directly to secret providers that are part of secret scanning's partner program. These alerts are not reported in the Security tab of the repository.
For in-depth information about each alert type, see About secret scanning alerts.
For details about all the supported patterns, see the Supported secrets section below.
If you use the REST API for secret scanning, you can use the Secret type to report on secrets from specific issuers. For more information, see REST API endpoints for secret scanning.
If you believe that secret scanning should have detected a secret committed to your repository, and it has not, you first need to check that GitHub supports your secret. For more information, refer to the following sections. For more advanced troubleshooting information, see Troubleshooting secret scanning.
Supported secrets
This table lists the secrets supported by secret scanning. You can see the types of alert that get generated for each token, as well as whether a validity check is performed on the token.
-
Provider: Name of the token provider.
-
Partner: Token for which leaks are reported to the relevant token partner. Applies to public repositories only.
-
User: Token for which leaks are reported to users on GitHub.
- Applies to public repositories, and to private repositories where GitHub Secret Protection and secret scanning are enabled.
- Includes default tokens, which relate to supported patterns and specified custom patterns, as well as non-provider tokens such as private keys, which usually have a higher ratio of false positives.
- For secret scanning to scan for non-provider patterns, the detection of non-provider patterns must be enabled for the repository or the organization. For more information, see Enabling secret scanning for your repository.
-
Push protection: Token for which leaks are reported to users on GitHub. Applies to repositories with secret scanning and push protection enabled.
-
Validity check: Token for which a validity check is implemented. For partner tokens, GitHub sends the token to the relevant partner. Note that not all partners are based in the United States. For more information, see Advanced Security in the Site Policy documentation.
Non-provider patterns
| Provider | Token |
|---|---|
| Generic | ec_private_key |
| Generic | http_basic_authentication_header |
| Generic | http_bearer_authentication_header |
| Generic | mongodb_connection_string |
| Generic | mysql_connection_string |
| Generic | openssh_private_key |
| Generic | pgp_private_key |
| Generic | postgres_connection_string |
| Generic | rsa_private_key |
Observação
Validity checks are not supported for non-provider patterns.
Copilot secret scanning
Secret scanning uses Copilot to detect generic passwords. See Responsible detection of generic secrets with Copilot secret scanning.
| Provider | Token |
|---|---|
| Generic | password |
Observação
Push protection and validity checks are not supported for passwords.
Default patterns
Observação
Validity checks are only available to users with GitHub Team or GitHub Enterprise who enable the feature as part of GitHub Secret Protection.
| Provider | Token | Partner | User | Push protection | Validity check | Base64 |
|---|---|---|---|---|---|---|
| 1Password | 1password_service_account_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| Adafruit | adafruit_io_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| Adobe | adobe_client_secret | ✓ | ✓ | ✓ | ✗ | ✗ |
| Adobe | adobe_device_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Adobe | adobe_pac_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Adobe | adobe_refresh_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Adobe | adobe_service_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Adobe | adobe_short_lived_access_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Aikido | aikido_api_client_secret | ✗ | ✓ | ✓ | ✗ | ✗ |
| Aikido | aikido_ci_scanning_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| Airtable | airtable_api_key | ✗ | ✓ | ✗ | ✗ | ✗ |
| Airtable | airtable_personal_access_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| Aiven | aiven_auth_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Aiven | aiven_service_password | ✓ | ✓ | ✓ | ✗ | ✗ |
| Alibaba | alibaba_cloud_access_key_id, alibaba_cloud_access_key_secret | ✓ | ✓ | ✓ | ✗ | ✗ |
| Amazon AWS | aws_access_key_id, aws_secret_access_key Token versions | ✓ | ✓ | ✓ | ✓ | ✓ |
| Amazon AWS | aws_api_key | ✓ | ✓ | ✗ | ✗ | ✗ |
| Amazon AWS | aws_secret_access_key, aws_session_token, aws_temporary_access_key_id | ✗ | ✓ | ✓ | ✓ | ✗ |
| Anthropic | anthropic_admin_api_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| Anthropic | anthropic_api_key Token versions | ✓ | ✓ | ✓ | ✓ | ✓ |
| Anthropic | anthropic_session_id | ✓ | ✓ | ✓ | ✗ | ✗ |
| Apify | apify_actor_run_api_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Apify | apify_actor_run_proxy_password | ✓ | ✓ | ✓ | ✗ | ✗ |
| Apify | apify_api_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Apify | apify_integration_api_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Apify | apify_proxy_password | ✓ | ✓ | ✓ | ✗ | ✗ |
| Apify | apify_ui_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Apify | apify_webhook_dispatch_api_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Asaas | asaas_api_token | ✓ | ✓ | ✗ | ✓ | ✗ |
| Asana | asana_legacy_format_personal_access_token | ✗ | ✓ | ✗ | ✗ | ✗ |
| Asana | asana_personal_access_token Token versions | ✗ | ✓ | ✓ | ✗ | ✗ |
| Atlassian | atlassian_api_token Token versions | ✓ | ✓ | ✓ | ✗ | ✗ |
| Atlassian | atlassian_jwt | ✓ | ✓ | ✓ | ✗ | ✗ |
| Authress | authress_service_client_access_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_active_directory_application_secret Token versions | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_active_directory_user_credential | ✓ | ✓ | ✗ | ✗ | ✗ |
| Azure | azure_ai_services_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_anomaly_detector_ee_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_anomaly_detector_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_apim_direct_management_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_apim_gateway_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_apim_repository_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| Azure | azure_apim_subscription_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_app_configuration_connection_string | ✗ | ✓ | ✓ | ✓ | ✗ |
| Azure | azure_app_configuration_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_batch_key_identifiable | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_cache_for_redis_access_key Token versions | ✓ | ✓ | ✓ | ✗ | ✓ |
| Azure | azure_cognitive_services_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_communication_services_connection_string | ✗ | ✓ | ✓ | ✓ | ✗ |
| Azure | azure_communication_services_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_computer_vision_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_container_registry_key_identifiable | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_content_moderator_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_content_safety_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_cosmosdb_key_identifiable Token versions | ✓ | ✓ | ✓ | ✗ | ✓ |
| Azure | azure_custom_vision_prediction_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_custom_vision_training_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_devops_personal_access_token Token versions | ✓ | ✓ | ✓ | ✓ | ✗ |
| Azure | azure_event_grid_key_identifiable Token versions | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_event_hub_key_identifiable | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_face_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_fluid_relay_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_form_recognizer_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_function_key Token versions | ✓ | ✓ | ✓ | ✗ | ✓ |
| Azure | azure_health_decision_support_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_health_insights_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_immersive_reader_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_internal_all_in_one_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_iot_device_connection_string | ✗ | ✓ | ✓ | ✓ | ✗ |
| Azure | azure_iot_device_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_iot_device_provisioning_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_iot_hub_connection_string | ✗ | ✓ | ✓ | ✓ | ✗ |
| Azure | azure_iot_hub_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_iot_provisioning_connection_string | ✗ | ✓ | ✓ | ✓ | ✗ |
| Azure | azure_knowledge_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_luis_authoring_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_luis_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_management_certificate | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_maps_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| Azure | azure_metrics_advisor_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_mixed_reality_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_ml_inference_identifiable_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_ml_internal_service_principal_identifiable_key | ✓ | ✗ | ✗ | ✗ | ✗ |
| Azure | azure_ml_web_service_classic_identifiable_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_openai_key Token versions | ✓ | ✓ | ✓ | ✗ | ✓ |
| Azure | azure_personalizer_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_qna_maker_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_qna_maker_v2_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_quantum_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_relay_key_identifiable | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_sas_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_search_admin_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_search_query_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_service_bus_identifiable | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_signalr_connection_string | ✗ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_signalr_key Token versions | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_speech_services_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_speech_translation_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_sql_connection_string | ✓ | ✓ | ✗ | ✗ | ✗ |
| Azure | azure_sql_internal_default_cloudsa_key | ✓ | ✗ | ✗ | ✗ | ✗ |
| Azure | azure_sql_password | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_storage_account_key Token versions | ✓ | ✓ | ✓ | ✗ | ✓ |
| Azure | azure_text_analytics_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_text_translation_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_video_intelligence_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_web_app_bot_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_web_pub_sub_connection_string | ✗ | ✓ | ✓ | ✗ | ✗ |
| Azure | azure_web_pub_sub_key Token versions | ✓ | ✓ | ✓ | ✗ | ✗ |
| Azure | microsoft_azure_entra_id_token | ✗ | ✓ | ✓ | ✓ | ✗ |
| Azure | microsoft_corporate_network_user_credential | ✓ | ✓ | ✗ | ✗ | ✗ |
| Baidu | baiducloud_api_accesskey | ✓ | ✓ | ✓ | ✗ | ✗ |
| Beamer | beamer_api_key | ✗ | ✓ | ✓ | ✗ | ✗ |
| Bitbucket | bitbucket_server_personal_access_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| Bitrise | bitrise_personal_access_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Bitrise | bitrise_workspace_api_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Block Protocol | block_protocol_api_key | ✗ | ✓ | ✗ | ✓ | ✗ |
| Brevo | sendinblue_api_key Token versions | ✓ | ✓ | ✓ | ✓ | ✓ |
| Brevo | sendinblue_smtp_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Buildkite | buildkite_agent_access_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Buildkite | buildkite_agent_job_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Buildkite | buildkite_agent_registration_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Buildkite | buildkite_cluster_queue_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Buildkite | buildkite_cluster_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Buildkite | buildkite_packages_registry_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Buildkite | buildkite_packages_temporary_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Buildkite | buildkite_portal_secret | ✓ | ✓ | ✓ | ✗ | ✗ |
| Buildkite | buildkite_portal_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Buildkite | buildkite_user_access_token | ✓ | ✓ | ✗ | ✗ | ✗ |
| Canadian Digital Service | cds_canada_notify_api_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| Canva | canva_app_secret | ✓ | ✓ | ✓ | ✗ | ✗ |
| Canva | canva_connect_api_secret | ✓ | ✓ | ✓ | ✗ | ✗ |
| Canva | canva_secret | ✓ | ✓ | ✓ | ✗ | ✗ |
| Cashfree | cashfree_api_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Cfx.re | cfxre_server_key | ✓ | ✓ | ✗ | ✗ | ✗ |
| Checkout.com | checkout_production_secret_key Token versions | ✓ | ✓ | ✓ | ✓ | ✗ |
| Checkout.com | checkout_test_secret_key Token versions | ✓ | ✓ | ✓ | ✓ | ✗ |
| Chief Tools | chief_tools_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| CircleCI | circleci_bot_access_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| CircleCI | circleci_personal_access_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| CircleCI | circleci_project_access_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| CircleCI | circleci_release_integration_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Clojars | clojars_deploy_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| CloudBees | codeship_credential | ✓ | ✗ | ✗ | ✗ | ✗ |
| Cockroach Labs | ccdb_api_key | ✓ | ✓ | ✗ | ✓ | ✗ |
| Cohere | cohere_api_key | ✗ | ✓ | ✗ | ✗ | ✗ |
| Contentful | contentful_personal_access_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Contentful | contentful_web_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Contributed Systems | contributed_systems_credentials | ✓ | ✗ | ✗ | ✗ | ✗ |
| Coveo | coveo_access_token | ✓ | ✗ | ✗ | ✗ | ✗ |
| Coveo | coveo_api_key | ✓ | ✗ | ✗ | ✗ | ✗ |
| crates.io | cratesio_api_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Databento | databento_api_key | ✓ | ✓ | ✗ | ✓ | ✗ |
| Databricks | databricks_access_token Token versions | ✓ | ✓ | ✓ | ✗ | ✓ |
| Datadog | datadog_api_key | ✓ | ✗ | ✗ | ✗ | ✗ |
| Datadog | datadog_app_key | ✓ | ✗ | ✗ | ✗ | ✗ |
| Datadog | datadog_rcm | ✗ | ✓ | ✗ | ✗ | ✗ |
| Datastax | datastax_astracs_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| DeepSeek | deepseek_api_key | ✗ | ✓ | ✗ | ✗ | ✗ |
| Defined Networking | defined_networking_nebula_api_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| DevCycle | devcycle_client_api_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| DevCycle | devcycle_mobile_api_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| DevCycle | devcycle_server_api_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| DigitalOcean | digitalocean_oauth_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| DigitalOcean | digitalocean_personal_access_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| DigitalOcean | digitalocean_refresh_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| DigitalOcean | digitalocean_system_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Discord | discord_bot_token Token versions | ✓ | ✓ | ✓ | ✓ | ✗ |
| Docker | docker_organization_access_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Docker | docker_personal_access_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Docker | docker_swarm_join_token | ✗ | ✓ | ✗ | ✗ | ✗ |
| Docker | docker_swarm_unlock_key | ✗ | ✓ | ✗ | ✗ | ✗ |
| Doppler | doppler_audit_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Doppler | doppler_cli_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Doppler | doppler_personal_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Doppler | doppler_scim_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Doppler | doppler_service_account_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Doppler | doppler_service_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Dropbox | dropbox_access_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Dropbox | dropbox_short_lived_access_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Duffel | duffel_live_access_token | ✗ | ✓ | ✓ | ✓ | ✗ |
| Duffel | duffel_test_access_token | ✗ | ✓ | ✓ | ✓ | ✗ |
| Dynatrace | dynatrace_api_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Dynatrace | dynatrace_internal_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| EasyPost | easypost_production_api_key | ✗ | ✓ | ✓ | ✗ | ✗ |
| EasyPost | easypost_test_api_key | ✗ | ✓ | ✗ | ✗ | ✗ |
| eBay | ebay_production_client_id, ebay_production_client_secret | ✗ | ✓ | ✓ | ✗ | ✗ |
| eBay | ebay_sandbox_client_id, ebay_sandbox_client_secret | ✗ | ✓ | ✓ | ✗ | ✗ |
| Elastic | elastic_cloud_api_key | ✗ | ✓ | ✓ | ✗ | ✗ |
| facebook_access_token | ✓ | ✓ | ✓ | ✓ | ✗ | |
| Fastly | fastly_api_token Token versions | ✓ | ✓ | ✗ | ✓ | ✗ |
| Figma | figma_pat | ✓ | ✓ | ✓ | ✓ | ✗ |
| Finicity | finicity_app_key | ✓ | ✓ | ✗ | ✗ | ✗ |
| Firebase | firebase_cloud_messaging_server_key | ✗ | ✓ | ✗ | ✗ | ✗ |
| Flutterwave | flutterwave_live_api_secret_key | ✗ | ✓ | ✓ | ✓ | ✗ |
| Flutterwave | flutterwave_test_api_secret_key | ✗ | ✓ | ✗ | ✓ | ✗ |
| Frame.io | frameio_developer_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Frame.io | frameio_jwt | ✓ | ✓ | ✓ | ✓ | ✗ |
| FullStory | fullstory_api_key Token versions | ✓ | ✓ | ✓ | ✓ | ✗ |
| GitHub | github_app_installation_access_token Token versions | ✓ | ✓ | ✓ | ✓ | ✓ |
| GitHub | github_oauth_access_token Token versions | ✓ | ✓ | ✓ | ✓ | ✓ |
| GitHub | github_personal_access_token Token versions | ✓ | ✓ | ✓ | ✓ | ✓ |
| GitHub | github_refresh_token Token versions | ✓ | ✓ | ✓ | ✓ | ✓ |
| GitHub | github_ssh_private_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| GitHub | github_test_token | ✓ | ✓ | ✗ | ✗ | ✗ |
| GitHub Secret Scanning | secret_scanning_sample_token Token versions | ✓ | ✓ | ✓ | ✗ | ✓ |
| GitLab | gitlab_access_token Token versions | ✗ | ✓ | ✓ | ✓ | ✓ |
| GoCardless | gocardless_live_access_token | ✓ | ✓ | ✗ | ✓ | ✗ |
| GoCardless | gocardless_sandbox_access_token | ✓ | ✓ | ✗ | ✓ | ✗ |
| google_api_key | ✓ | ✓ | ✗ | ✓ | ✗ | |
| google_cloud_service_account_credentials | ✓ | ✓ | ✓ | ✓ | ✗ | |
| google_cloud_storage_access_key_secret, google_cloud_storage_service_account_access_key_id | ✓ | ✓ | ✓ | ✗ | ✗ | |
| google_cloud_storage_access_key_secret, google_cloud_storage_user_access_key_id | ✓ | ✓ | ✓ | ✗ | ✗ | |
| google_gcp_api_key_bound_service_account | ✓ | ✓ | ✗ | ✗ | ✗ | |
| google_gemini_api_key | ✗ | ✓ | ✗ | ✗ | ✗ | |
| google_oauth_access_token | ✓ | ✓ | ✓ | ✓ | ✗ | |
| google_oauth_client_id, google_oauth_client_secret Token versions | ✓ | ✓ | ✓ | ✗ | ✗ | |
| google_oauth_refresh_token Token versions | ✓ | ✓ | ✓ | ✗ | ✓ | |
| Grafana | grafana_cloud_api_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| Grafana | grafana_cloud_api_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Grafana | grafana_project_api_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Grafana | grafana_project_service_account_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Groq | groq_api_key Token versions | ✓ | ✓ | ✓ | ✓ | ✓ |
| GuardSquare | guardsquare_appsweep_api_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| GuardSquare | guardsquare_cli_access_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| GuardSquare | guardsquare_maven_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| HashiCorp | hashicorp_vault_batch_token Token versions | ✗ | ✓ | ✓ | ✗ | ✗ |
| HashiCorp | hashicorp_vault_root_service_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| HashiCorp | hashicorp_vault_service_token Token versions | ✗ | ✓ | ✓ | ✗ | ✗ |
| HashiCorp | terraform_api_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| hCaptcha | hcaptcha_siteverify_secret | ✗ | ✓ | ✓ | ✗ | ✗ |
| Heroku | heroku_platform_api_oauth2_token | ✗ | ✓ | ✓ | ✓ | ✗ |
| Heroku | heroku_postgres_connection_url | ✗ | ✓ | ✗ | ✗ | ✗ |
| Highnote | highnote_rk_live_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Highnote | highnote_rk_test_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Highnote | highnote_sk_live_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| Highnote | highnote_sk_test_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| HOP | hop_bearer | ✓ | ✓ | ✓ | ✗ | ✗ |
| HOP | hop_pat | ✓ | ✓ | ✓ | ✗ | ✗ |
| HOP | hop_ptk | ✓ | ✓ | ✓ | ✗ | ✗ |
| Hubspot | hubspot_api_key Token versions | ✓ | ✓ | ✓ | ✗ | ✗ |
| Hubspot | hubspot_personal_access_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Hubspot | hubspot_private_apps_user_token | ✓ | ✓ | ✗ | ✗ | ✗ |
| Hubspot | hubspot_smtp_credential Token versions | ✓ | ✓ | ✗ | ✗ | ✗ |
| Hugging Face | hf_org_api_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Hugging Face | hf_user_access_token Token versions | ✓ | ✓ | ✓ | ✓ | ✓ |
| IBM | ibm_cloud_iam_key | ✓ | ✗ | ✗ | ✗ | ✗ |
| Intercom | intercom_access_token | ✗ | ✓ | ✓ | ✓ | ✗ |
| Ionic | ionic_personal_access_token Token versions | ✓ | ✓ | ✓ | ✗ | ✗ |
| Ionic | ionic_refresh_token Token versions | ✓ | ✓ | ✓ | ✗ | ✗ |
| Iterative | iterative_dvc_studio_access_token | ✓ | ✗ | ✗ | ✗ | ✗ |
| JFrog | jfrog_platform_access_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| JFrog | jfrog_platform_api_key | ✗ | ✓ | ✓ | ✗ | ✗ |
| JFrog | jfrog_platform_reference_token Token versions | ✗ | ✓ | ✓ | ✗ | ✓ |
| Langchain | langchain_api_personal_key | ✗ | ✓ | ✓ | ✗ | ✗ |
| Langchain | langchain_api_server_key | ✗ | ✓ | ✗ | ✗ | ✗ |
| LaunchDarkly | launchdarkly_access_token | ✓ | ✓ | ✗ | ✗ | ✗ |
| Lichess | lichess_oauth_access_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Lichess | lichess_personal_access_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Lightspeed | lightspeed_xs_pat | ✗ | ✓ | ✓ | ✗ | ✗ |
| Linear | linear_api_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Linear | linear_oauth_access_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| linkedin_client_secret | ✗ | ✓ | ✓ | ✗ | ✗ | |
| Lob | lob_live_api_key | ✗ | ✓ | ✗ | ✓ | ✗ |
| Lob | lob_test_api_key | ✗ | ✓ | ✓ | ✓ | ✗ |
| Localstack | localstack_api_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| LogicMonitor | logicmonitor_bearer_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| LogicMonitor | logicmonitor_lmv1_access_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Login with Amazon | amazon_oauth_client_id, amazon_oauth_client_secret | ✓ | ✓ | ✓ | ✗ | ✗ |
| Mailchimp | mailchimp_api_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| Mailchimp | mandrill_api_key | ✓ | ✗ | ✗ | ✗ | ✗ |
| Mailersend | mailersend_api_token | ✓ | ✗ | ✗ | ✗ | ✗ |
| Mailersend | mailersend_smtp_password | ✓ | ✗ | ✗ | ✗ | ✗ |
| Mailersend | mailersend_smtp_username | ✓ | ✗ | ✗ | ✗ | ✗ |
| Mailgun | mailgun_api_key Token versions | ✓ | ✓ | ✓ | ✓ | ✗ |
| Mailgun | mailgun_smtp_credential | ✓ | ✗ | ✗ | ✗ | ✗ |
| Mapbox | mapbox_secret_access_token | ✗ | ✓ | ✗ | ✓ | ✗ |
| MaxMind | maxmind_license_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| Mercury | mercury_non_production_api_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Mercury | mercury_production_api_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Mergify | mergify_application_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| MessageBird | messagebird_api_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Midtrans | midtrans_production_server_key | ✗ | ✓ | ✓ | ✓ | ✗ |
| Midtrans | midtrans_sandbox_server_key | ✗ | ✓ | ✗ | ✓ | ✗ |
| Mistral AI | mistral_ai_api_key | ✗ | ✓ | ✗ | ✗ | ✗ |
| MongoDB | mongodb_atlas_db_uri_with_credentials | ✓ | ✓ | ✗ | ✓ | ✗ |
| MongoDB | mongodb_atlas_service_account_secret | ✓ | ✓ | ✓ | ✗ | ✗ |
| Naver Cloud | navercloud_gov_access_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Naver Cloud | navercloud_gov_access_key_secret | ✓ | ✓ | ✓ | ✗ | ✗ |
| Naver Cloud | navercloud_gov_sts | ✓ | ✓ | ✓ | ✗ | ✗ |
| Naver Cloud | navercloud_gov_sts_secret | ✓ | ✓ | ✓ | ✗ | ✗ |
| Naver Cloud | navercloud_pub_access_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Naver Cloud | navercloud_pub_access_key_secret | ✓ | ✓ | ✓ | ✗ | ✗ |
| Naver Cloud | navercloud_pub_sts | ✓ | ✓ | ✓ | ✗ | ✗ |
| Naver Cloud | navercloud_pub_sts_secret | ✓ | ✓ | ✓ | ✗ | ✗ |
| Neon | neon_api_key | ✓ | ✗ | ✗ | ✗ | ✗ |
| Neon | neon_connection_uri | ✓ | ✗ | ✗ | ✗ | ✗ |
| Netflix | netflix_netkey | ✓ | ✓ | ✗ | ✗ | ✗ |
| New Relic | new_relic_insights_query_key | ✗ | ✓ | ✓ | ✗ | ✗ |
| New Relic | new_relic_license_key | ✗ | ✓ | ✗ | ✗ | ✗ |
| New Relic | new_relic_personal_api_key | ✗ | ✓ | ✓ | ✗ | ✗ |
| New Relic | new_relic_rest_api_key | ✗ | ✓ | ✓ | ✗ | ✗ |
| Notion | notion_api_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Notion | notion_integration_token | ✗ | ✓ | ✓ | ✓ | ✗ |
| Notion | notion_oauth_client_secret | ✗ | ✓ | ✓ | ✗ | ✗ |
| npm | npm_access_token Token versions | ✓ | ✓ | ✓ | ✗ | ✗ |
| NuGet | nuget_api_key Token versions | ✓ | ✓ | ✓ | ✓ | ✗ |
| Octopus Deploy | octopus_deploy_api_key | ✓ | ✓ | ✗ | ✗ | ✗ |
| Oculus | oculus_access_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| OneChronos | onechronos_api_key | ✗ | ✓ | ✓ | ✗ | ✗ |
| OneChronos | onechronos_eb_api_key | ✗ | ✓ | ✓ | ✗ | ✗ |
| OneChronos | onechronos_eb_encryption_key | ✗ | ✓ | ✓ | ✗ | ✗ |
| OneChronos | onechronos_oauth_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| OneChronos | onechronos_refresh_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| OneSignal | onesignal_rich_authentication_token | ✓ | ✗ | ✗ | ✗ | ✗ |
| Onfido | onfido_live_api_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Onfido | onfido_sandbox_api_token | ✓ | ✓ | ✗ | ✓ | ✗ |
| OpenAI | openai_api_key Token versions | ✓ | ✓ | ✓ | ✓ | ✗ |
| OpenRouter | openrouter_api_key | ✓ | ✓ | ✗ | ✓ | ✗ |
| OpenVSX | openvsx_access_token Token versions | ✗ | ✓ | ✗ | ✗ | ✗ |
| Openweather | openweather_api_key | ✗ | ✓ | ✗ | ✗ | ✗ |
| Oracle | oracle_api_key | ✓ | ✗ | ✗ | ✗ | ✗ |
| Orbit | orbit_api_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| PagerDuty | pagerduty_oauth_secret | ✗ | ✓ | ✓ | ✗ | ✗ |
| PagerDuty | pagerduty_oauth_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| Palantir | palantir_jwt | ✓ | ✓ | ✓ | ✗ | ✗ |
| Pangea | pangea_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| Perplexity | perplexity_api_key | ✗ | ✓ | ✓ | ✗ | ✗ |
| Persona Identities | persona_production_api_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| Persona Identities | persona_sandbox_api_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| Pineapple Technologies Limited | pineapple_technologies_incident_api_key | ✓ | ✗ | ✗ | ✗ | ✗ |
| Pinecone | pinecone_api_key, pinecone_environment | ✗ | ✓ | ✗ | ✗ | ✗ |
| pinterest_access_token | ✓ | ✓ | ✓ | ✗ | ✗ | |
| pinterest_refresh_token | ✓ | ✓ | ✓ | ✗ | ✗ | |
| PlanetScale | planetscale_database_password | ✓ | ✓ | ✓ | ✗ | ✗ |
| PlanetScale | planetscale_oauth_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| PlanetScale | planetscale_service_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Planning Center | planning_center_oauth_access_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Planning Center | planning_center_oauth_app_secret | ✓ | ✓ | ✓ | ✗ | ✗ |
| Planning Center | planning_center_personal_access_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Plivo | plivo_auth_id, plivo_auth_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Polar | polar_access_token Token versions | ✓ | ✓ | ✓ | ✓ | ✗ |
| Polar | polar_authorization_code Token versions | ✓ | ✓ | ✓ | ✗ | ✗ |
| Polar | polar_client_registration_token Token versions | ✓ | ✓ | ✓ | ✗ | ✗ |
| Polar | polar_client_secret Token versions | ✓ | ✓ | ✓ | ✗ | ✗ |
| Polar | polar_customer_session_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Polar | polar_personal_access_token Token versions | ✓ | ✓ | ✓ | ✗ | ✗ |
| Polar | polar_refresh_token Token versions | ✓ | ✓ | ✓ | ✗ | ✗ |
| Polar | polar_user_session_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Postman | postman_api_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| Postman | postman_collection_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| Prefect | prefect_server_api_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Prefect | prefect_user_api_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Proctorio | proctorio_consumer_key | ✓ | ✓ | ✗ | ✗ | ✗ |
| Proctorio | proctorio_linkage_key | ✓ | ✓ | ✗ | ✗ | ✗ |
| Proctorio | proctorio_registration_key | ✓ | ✓ | ✗ | ✗ | ✗ |
| Proctorio | proctorio_secret_key Token versions | ✓ | ✓ | ✓ | ✗ | ✗ |
| Pulumi | pulumi_access_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| PyPI | pypi_api_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Rainforest Pay | rainforest_api_key | ✓ | ✗ | ✗ | ✗ | ✗ |
| Rainforest Pay | rainforest_sandbox_api_key | ✓ | ✗ | ✗ | ✗ | ✗ |
| Ramp | ramp_client_id | ✓ | ✓ | ✓ | ✗ | ✗ |
| Ramp | ramp_client_secret | ✓ | ✓ | ✓ | ✗ | ✗ |
| Ramp | ramp_oauth_token | ✓ | ✓ | ✗ | ✗ | ✗ |
| Raycast | raycast_access_token | ✓ | ✗ | ✗ | ✗ | ✗ |
| ReadMe | readmeio_api_access_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| redirect.pizza | redirect_pizza_api_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Replicate | replicate_api_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Rootly | rootly_api_key | ✗ | ✓ | ✓ | ✓ | ✗ |
| RubyGems | rubygems_api_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| RunPod | runpod_api_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| Salesforce | salesforce_access_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| Salesforce | salesforce_oauth2_consumer_key, salesforce_oauth2_consumer_secret | ✗ | ✓ | ✓ | ✗ | ✗ |
| Salesforce | salesforce_refresh_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| Samsara | samsara_api_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Samsara | samsara_oauth_access_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Scalr | scalr_api_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Segment | segment_public_api_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| SendGrid | sendgrid_api_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| Sentry | sentry_integration_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| Sentry | sentry_org_auth_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| Sentry | sentry_user_app_auth_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| Sentry | sentry_user_auth_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| Shippo | shippo_live_api_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| Shippo | shippo_test_api_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| Shopee | shopee_open_platform_partner_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Shopify | shopify_access_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Shopify | shopify_app_client_credentials | ✓ | ✓ | ✓ | ✗ | ✗ |
| Shopify | shopify_app_client_secret | ✓ | ✓ | ✗ | ✗ | ✗ |
| Shopify | shopify_app_shared_secret | ✓ | ✓ | ✓ | ✗ | ✗ |
| Shopify | shopify_custom_app_access_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Shopify | shopify_marketplace_token | ✓ | ✓ | ✗ | ✗ | ✗ |
| Shopify | shopify_merchant_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Shopify | shopify_partner_api_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Shopify | shopify_private_app_password | ✓ | ✓ | ✓ | ✗ | ✗ |
| Siemens | siemens_api_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Siemens | siemens_code_token | ✓ | ✗ | ✗ | ✗ | ✗ |
| Sindri | sindri_api_key Token versions | ✓ | ✓ | ✗ | ✓ | ✗ |
| Slack | slack_api_token Token versions | ✓ | ✓ | ✓ | ✓ | ✗ |
| Slack | slack_incoming_webhook_url | ✓ | ✓ | ✓ | ✓ | ✗ |
| Slack | slack_workflow_webhook_url | ✓ | ✓ | ✓ | ✗ | ✗ |
| Snowflake | snowflake_programmatic_access_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Sourcegraph | sourcegraph_access_token | ✓ | ✓ | ✗ | ✓ | ✗ |
| Sourcegraph | sourcegraph_dotcom_user_gateway | ✓ | ✓ | ✓ | ✗ | ✗ |
| Sourcegraph | sourcegraph_instance_identifier_access_token | ✓ | ✓ | ✗ | ✓ | ✗ |
| Sourcegraph | sourcegraph_license_key_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Sourcegraph | sourcegraph_product_subscription_token | ✓ | ✓ | ✗ | ✗ | ✗ |
| Square | square_access_token Token versions | ✗ | ✓ | ✓ | ✓ | ✗ |
| Square | square_production_application_secret | ✗ | ✓ | ✓ | ✗ | ✗ |
| Square | square_sandbox_application_secret | ✗ | ✓ | ✓ | ✗ | ✗ |
| SSLMate | sslmate_api_key Token versions | ✓ | ✓ | ✓ | ✓ | ✗ |
| SSLMate | sslmate_cluster_secret | ✓ | ✓ | ✓ | ✗ | ✗ |
| Stripe | stripe_api_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| Stripe | stripe_legacy_api_key | ✓ | ✗ | ✗ | ✗ | ✗ |
| Stripe | stripe_live_restricted_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Stripe | stripe_test_restricted_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Stripe | stripe_test_secret_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| Stripe | stripe_webhook_signing_secret | ✓ | ✓ | ✗ | ✗ | ✗ |
| Supabase | supabase_service_key Token versions | ✓ | ✓ | ✗ | ✗ | ✗ |
| Tableau | tableau_personal_access_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| Tailscale | tailscale_api_key | ✓ | ✓ | ✗ | ✓ | ✗ |
| Telegram | telegram_bot_token | ✗ | ✓ | ✗ | ✓ | ✗ |
| Telnyx | telnyx_api_v2_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| Temporal | temporal_cloud_api_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Tencent | tencent_cloud_intl_access_token | ✓ | ✓ | ✗ | ✗ | ✗ |
| Tencent | tencent_cloud_secret_id | ✓ | ✓ | ✓ | ✗ | ✗ |
| Tencent | tencent_wechat_api_app_id | ✓ | ✓ | ✗ | ✗ | ✗ |
| Tencent | tencent_wechat_pay_token | ✗ | ✓ | ✗ | ✗ | ✗ |
| Thunderstore | thunderstore_io_api_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| Twilio | twilio_access_token | ✗ | ✓ | ✓ | ✗ | ✗ |
| Twilio | twilio_account_sid Token versions | ✓ | ✓ | ✓ | ✗ | ✓ |
| Twilio | twilio_api_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Typeform | typeform_personal_access_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Uniwise | wiseflow_api_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| Unkey | unkey_root_key | ✓ | ✓ | ✗ | ✓ | ✗ |
| Val Town | val_town_api_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| VolcEngine | volcengine_access_key_id | ✓ | ✓ | ✓ | ✗ | ✗ |
| Wakatime | wakatime_api_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| Wakatime | wakatime_app_secret | ✓ | ✓ | ✓ | ✗ | ✗ |
| Wakatime | wakatime_oauth_access_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Wakatime | wakatime_oauth_refresh_token | ✓ | ✓ | ✓ | ✗ | ✗ |
| Weights & Biases | wandb_api_key | ✗ | ✓ | ✗ | ✗ | ✗ |
| Workato | workato_developer_api_token Token versions | ✓ | ✓ | ✓ | ✓ | ✗ |
| WorkOS | workos_production_api_key Token versions | ✓ | ✓ | ✓ | ✗ | ✗ |
| WorkOS | workos_staging_api_key Token versions | ✓ | ✓ | ✓ | ✗ | ✗ |
| xAI | xai_api_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| Yandex | yandex_cloud_api_key | ✓ | ✓ | ✓ | ✓ | ✗ |
| Yandex | yandex_cloud_iam_access_secret | ✓ | ✓ | ✓ | ✗ | ✗ |
| Yandex | yandex_cloud_iam_cookie | ✓ | ✓ | ✓ | ✗ | ✗ |
| Yandex | yandex_cloud_iam_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Yandex | yandex_cloud_smartcaptcha_server_key | ✓ | ✓ | ✓ | ✗ | ✗ |
| Yandex | yandex_dictionary_api_key | ✗ | ✓ | ✓ | ✗ | ✗ |
| Yandex | yandex_passport_oauth_token | ✓ | ✓ | ✓ | ✓ | ✗ |
| Yandex | yandex_predictor_api_key | ✗ | ✓ | ✓ | ✗ | ✗ |
| Yandex | yandex_translate_api_key | ✗ | ✓ | ✓ | ✓ | ✗ |
| ZenHub | zenhub_personal_api_key | ✗ | ✓ | ✓ | ✗ | ✗ |
| Zuplo | zuplo_consumer_api_key | ✓ | ✓ | ✓ | ✓ | ✗ |
Token versions
Service providers update the patterns used to generate tokens periodically and may support more than one version of a token. Push protection only supports the most recent token versions that secret scanning can identify with confidence. This avoids push protection blocking commits unnecessarily when a result may be a false positive, which is more likely to happen with legacy tokens.
Multi-part secrets
By default, secret scanning supports validation for pair-matched access keys and key IDs.
Secret scanning also supports validation for individual key IDs for Amazon AWS Access Key IDs, in addition to existing pair matching.
A key ID will show as active if secret scanning confirms the key ID exists, regardless of whether or not a corresponding access key is found. The key ID will show as inactive if it's invalid (for example, if it is not a real key ID).
Where a valid pair is found, the secret scanning alerts will be linked.