Apify API tokens

• Provider documentation apify/awesome-skills lint_references.py TOKEN_RE = apify_api_[A-Za-z0-9]{20,} (added in 4ba9177 by an Apify collaborator, 2026-08-12; ruling R2) and the apify_api_... docs placeholders (ruling R4) · observed 2026-09-28 · apify_api_ + at least 20 alphanumerics, open-ended; no separator or checksum
• trufflehog 3.97.4
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9
• Reference 10
• Reference 11

Arrival evidence (#436, product redact-secret#916; #860 handoff apify.md, READY with an open-ended body). T1: the prefix is the provider's docs placeholder apify_api_... (R4), and the alphabet and the 20-byte floor are the provider-authored leak linter TOKEN_RE = apify_api_[A-Za-z0-9]{20,} (R2; the handoff checked the author and that it matches no public scanner rule). No provider source states an exact width: trufflehog's exact 36 is T2, and the product's 128-byte cap is streaming policy, so positives carry 20, 36 and 128 and nothing asserts silence on a longer run. Excluded: apify_ui_ Console tokens (prefix T1 under R6 but no shape), Actor-run, integration and webhook-dispatch tokens (no public shape), the unprefixed proxy password, placeholders whose _ or . breaks the run below 20, and APIFY_API_ identifiers (the prefix is case-sensitive). Graduated to a registry detector at the 1127bf9 re-pin (redact-secret PR #938).