Confluent Cloud API secrets

• Provider documentation cflt-prefixed API secret (created after 2025-07-30) · observed 2026-09-23 · the page states "API secrets created after July 30, 2025 have a cflt prefix followed by 60 characters consisting of A-Z, a-z, 0-9, + or /" and that "the final 6 characters contain a Base64-encoded CRC32 checksum of the prior 54 characters"; its own secret-detection snippet fixes the algorithm (CRC32 over the 54 characters after cflt, little-endian bytes, standard Base64, first 6 characters), so the checksum is recomputable and `validate` enforces it (#209, research #234)
• trufflehog 3.97.4
• gitleaks 8.30.1

Prefix, body length, alphabet and checksum are provider-documented on docs.confluent.io; the checksum's exact byte range, byte order and encoding come from the provider's own published snippet (provider code on the documentation page). Re-checked 2026-09-24 (#234): an earlier revision of this contract recorded the checksum as documented but outside the lexical contract, and the product source (confluent.rs) says the provider does not publish it precisely enough to recompute; both are superseded, since the snippet reproduces the page's own example exactly and fails it with big-endian bytes or with the prefix included. `pattern` keeps the lexical shape and `validate` adds the checksum, so a checksum-invalid 64-character value is outside the contract: the detector-coverage prefixed-shape positives, first generated before this correction as flat random bodies that failed the checksum, were regenerated with a valid checksum over their unchanged first 54 body characters (#213), and #209's beta8-209 positives are checksum-valid by construction. Neither pinned tool registers the cflt-prefixed shape itself: gitleaks 8.30.1's confluent-secret-key rule and trufflehog 3.97.4's confluent detector each match a keyword-gated bare 64-byte body (gitleaks over a case-insensitive [a-z0-9], so it misses any secret containing "+" or "/"; trufflehog over [a-zA-Z0-9+/], reporting only a key-ID and secret pair), so both are cited as corroboration of the 64-byte total width, not of the prefix or checksum, and a bare prefixed secret with no keyword is an expected peer false negative. Neither validates the checksum. The unprefixed pre-2025-07-30 generation is the separate confluent-cloud-api-secret-legacy contract. The API key ID — documented as "not considered secret information" (example shape: 16 upper-case letters and digits) — is the family's public-identifier control, never a positive. redact-secret#309 (PR #667) froze the prefix and length grammar on the product side without the checksum.