API Key Detection

​

Policy JSON

{
  "secrets": {
    "enabled": true,
    "confidence_threshold": 0.8,
    "categories": ["api_keys", "tokens"],
    "actions": {
      "critical": "DENY",
      "high": "DENY",
      "medium": "REDACT"
    }
  }
}

policy = {
    "secrets": {
        "enabled": True,
        "confidence_threshold": 0.8,
        "categories": ["api_keys", "tokens"],
        "actions": {
            "critical": "DENY",
            "high": "DENY",
            "medium": "REDACT",
        },
    }
}

​

What It Does

• Scans for API keys and tokens across 500+ patterns covering OpenAI, Anthropic, AWS, GCP, Azure, Stripe, GitHub, and more
• Scores each finding by confidence (0.0–1.0) and severity (critical, high, medium, low)
• Denies requests containing critical or high-confidence secrets
• Redacts medium-confidence findings to avoid blocking on false positives
• Deterministic pattern matching — no LLM calls in the detection path

​

Example

Can you help me debug this? My API key is sk-proj-abc123def456ghi789...

{
  "action": "DENY",
  "risk_score": 0.95,
  "reasons": ["secret_detected"],
  "evidence": {
    "findings": [
      {
        "type": "openai_api_key",
        "category": "api_keys",
        "confidence": 0.98,
        "severity": "critical",
        "action_taken": "DENY"
      }
    ]
  }
}

​

Install

# Install via CLI
tealtiger policy install api-key-detection

# Or copy the JSON above into your tealtiger.config.json

​

Customize

​

Related

• Cloud Secrets — AWS — Targeted AWS credential detection
• Credential Rotation — 90 Day — Enforce credential freshness
• Deny Secrets in Memory — Prevent secrets from persisting in memory
• TealSecrets Documentation — Full API reference