Composio API keys

• Provider documentation provider staff statement of 2026-09-17 (ak_ + 20 nanoid) and the provider OpenAPI example (ak_ + 20) · observed 2026-09-28 · a dated statement by Composio's Head of Security (ruling R3) and the provider OpenAPI example fix ak_ + exactly 20 [A-Za-z0-9_-]; the docs name the prefix and the x-api-key header
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9
• Reference 10
• Reference 11
• Reference 12
• Reference 13
• Reference 14
• Reference 15

Arrival evidence (#434, product redact-secret#909; #860 handoff composio.md, READY). The project key has full access to one project and its connected third-party accounts. T1 on every fact: documented prefix, a dated provider-staff statement (R3) for the width and alphabet, the OpenAPI example for the width and the CLI redaction regex for the alphabet (R2). The short ak_ prefix with a _/- alphabet would match snake_case and kebab-case identifiers, so the contract carries the handoff's mixed-case guard (at least one upper- and one lower-case letter; ~6e-5 of random bodies fail it, an accepted false negative), and all-lower/all-upper bodies back twins. A mixed-case 20-byte identifier after ak_ remains an accepted false positive. bkend.ai's ak_ + 64 hex is another provider's credential and a twin, not a control. Neither pinned peer has a Composio rule. Graduated to a registry detector at the 1127bf9 re-pin (redact-secret PR #938).