API Key Detection

Scan agent input and output for API keys and tokens using TealSecrets’ pattern library. Critical and high-confidence findings are denied outright; medium-confidence findings are redacted to prevent false-positive blocking.

Policy JSON

{
  "secrets": {
    "enabled": true,
    "confidence_threshold": 0.8,
    "categories": ["api_keys", "tokens"],
    "actions": {
      "critical": "DENY",
      "high": "DENY",
      "medium": "REDACT"
    }
  }
}

policy = {
    "secrets": {
        "enabled": True,
        "confidence_threshold": 0.8,
        "categories": ["api_keys", "tokens"],
        "actions": {
            "critical": "DENY",
            "high": "DENY",
            "medium": "REDACT",
        },
    }
}

What It Does

Scans for API keys and tokens across 500+ patterns covering OpenAI, Anthropic, AWS, GCP, Azure, Stripe, GitHub, and more
Scores each finding by confidence (0.0–1.0) and severity (critical, high, medium, low)
Denies requests containing critical or high-confidence secrets
Redacts medium-confidence findings to avoid blocking on false positives
Deterministic pattern matching — no LLM calls in the detection path

Example

User input:

Can you help me debug this? My API key is sk-proj-abc123def456ghi789...

Decision object:

{
  "action": "DENY",
  "risk_score": 0.95,
  "reasons": ["secret_detected"],
  "evidence": {
    "findings": [
      {
        "type": "openai_api_key",
        "category": "api_keys",
        "confidence": 0.98,
        "severity": "critical",
        "action_taken": "DENY"
      }
    ]
  }
}

Install

# Install via CLI
tealtiger policy install api-key-detection

# Or copy the JSON above into your tealtiger.config.json

Customize

Setting	Default	Description
`confidence_threshold`	`0.8`	Minimum confidence to trigger an action. Lower = more sensitive
`categories`	`["api_keys", "tokens"]`	Secret categories to scan. Also available: `passwords`, `certificates`, `cloud_secrets`, `database_urls`
`actions.critical`	`DENY`	Action for critical-severity findings
`actions.high`	`DENY`	Action for high-severity findings
`actions.medium`	`REDACT`	Action for medium-severity findings

Setting all severity levels to DENY may cause false-positive blocks on code snippets that resemble API key patterns. Use REDACT for medium-confidence findings in development environments.

Cloud Secrets — AWS — Targeted AWS credential detection
Credential Rotation — 90 Day — Enforce credential freshness
Deny Secrets in Memory — Prevent secrets from persisting in memory
TealSecrets Documentation — Full API reference

Getting Started

Core Concepts

Governance Domains

Policy Authoring

Architecture

Integrations

Deployment

API Reference

Cookbook

Compliance & GRC

Guides

Reference

Versions

Playground

Dashboard

Blog

Policy JSON

What It Does

Example

Install

Customize

​Policy JSON

​What It Does

​Example

​Install

​Customize

​Related

Policy JSON

What It Does

Example

Install

Customize

Related