redact-secret · Report · Detector
ElevenLabs API keys
Format evidence
- Provider documentation SpeechEngineServer docstring api_key="sk_..." and the _residency_ suffix regex in elevenlabs-python and elevenlabs-js · observed 2026-09-26 · ElevenLabs' own SDK source shows keys written sk_... and parses a data-residency suffix with _residency_[a-z0-9]+$ (elevenlabs-python speech_engine/resource.py, elevenlabs-js SpeechEngineResource.ts). No documentation page states the prefix, a length or an alphabet. Provider code is not documentation; T1 on it is the maintainer ruling of 2026-09-27 (redact-secret#788, huggingface:api-token precedent), scoped to the sk_ prefix and the _residency_ suffix grammar. The 48-hex body stays T2
- trufflehog 3.97.4
- betterleaks
- Reference 1
- Reference 2
- Reference 3
- Reference 4
- Reference 5
- Reference 6
- Reference 7
- Reference 8
- Reference 9
- Reference 10
Arrival evidence (#384, product redact-secret#865; research #788), T1 by maintainer ruling of 2026-09-27 on provider SDK code for the sk_ prefix and the _residency_ suffix grammar, graduated to a registry detector at cfe2aec. The body claims below stay T2 and no fixture asserts them: the sk_ prefix and the _residency_<region> suffix rest on ElevenLabs' own SDK source, the 48-lowercase-hex body on trufflehog's v2 detector, betterleaks and about 35 code-search fragments (each fully formed body was 48 hex characters), and no ElevenLabs page states any of it. Both tool rules are keyword-gated on elevenlabs, xi-api-key or xi_api_key; the contract claims the bare shape, as the product issue does, on the strength of the sk_ prefix, so nothing here relies on the gate. sk_ is shared with Stripe (sk_live_, sk_test_, sk_org_) and, by plan, Pollinations (sk_ + 32 characters): the Stripe shape is a prefix twin and a bare sk_ prefix cannot attribute a value. A legacy bare 32-hex form has trufflehog v1 evidence only and stays unasserted either way. Uppercase hex is disputed between the tools (betterleaks matches case-insensitively, trufflehog v2 does not), so no fixture asserts silence on it.
What the run recorded, by group
| Group | Fixtures | Leaked or false alarms | Near-twins | Outcomes | Other scanners, same cell |
|---|---|---|---|---|---|
| Must not flag · Tool-corroborated | 14 | False alarmsat most 21.5%0 of 14 controls flagged | 14 quiet · 0 flagged |
| |
| Must not flag · Project policy | 8 | False alarmsat most 32.4%0 of 8 controls flagged | 8 quiet · 0 flagged |
| |
| Must redact · Provider-documented | 13 | Secret spans left readableat most 22.8%0 of 13 spans | Near-twins told apartinsufficient-coverage5 of 5 pairs | 13 redacted · 0 too much · 0 partly exposed · 0 missed |
|
| Pending review | 3 | UnscoredNot scoredInspect only: never scored until evidence exists | Not scored |
- Fixtures
- 38
- Left readable
- 0
- Redacted too much
- 0
- False alarms
- 0
Fixtures for this detector
| Fixture | Kind and evidence | redact-secret |
|---|---|---|
elevenlabs-api-key-curl-xi-api-keyelevenlabs · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
elevenlabs-api-key-dotenvelevenlabs · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
elevenlabs-api-key-export-xi-api-keyelevenlabs · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
elevenlabs-api-key-hashed-key-encoded-valueelevenlabs · benign-encoded-value | Must not flagT2 · Tool-corroborated | Quiet |
elevenlabs-api-key-js-clientelevenlabs · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
elevenlabs-api-key-key-shape-bareelevenlabs · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
elevenlabs-api-key-key-shape-quotedelevenlabs · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
elevenlabs-api-key-key-shape-unicode-crlfelevenlabs · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
elevenlabs-api-key-pasted-keyelevenlabs · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
elevenlabs-api-key-python-multi-lineelevenlabs · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
elevenlabs-api-key-python-single-lineelevenlabs · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
elevenlabs-api-key-residency-suffixelevenlabs · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
elevenlabs-api-key-tool-callelevenlabs · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
elevenlabs-api-key-yaml-configelevenlabs · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
elevenlabs-api-key-stripe-shaped-twincross-provider · prefix-near-miss | Must not flagT2 · Tool-corroborated · twin | Quiet |
elevenlabs-api-key-stripe-test-shaped-twincross-provider · prefix-near-miss | Must not flagT2 · Tool-corroborated · twin | Quiet |
elevenlabs-api-key-ak-prefix-twinelevenlabs · prefix-near-miss | Must not flagT2 · Tool-corroborated · twin | Quiet |
elevenlabs-api-key-docs-ellipsis-placeholderelevenlabs · documentation-placeholder | Must not flagT3 · Project policy | Quiet |
elevenlabs-api-key-embedded-leading-twinelevenlabs · boundary-violation | Must not flagT2 · Tool-corroborated · twin | Quiet |
elevenlabs-api-key-env-reference-referenceelevenlabs · templated-reference | Must not flagT3 · Project policy | Quiet |
elevenlabs-api-key-hyphen-prefix-twinelevenlabs · prefix-near-miss | Must not flagT2 · Tool-corroborated · twin | Quiet |
elevenlabs-api-key-key-hint-public-idelevenlabs · public-identifier | Must not flagT2 · Tool-corroborated | Quiet |
elevenlabs-api-key-key-id-public-idelevenlabs · public-identifier | Must not flagT2 · Tool-corroborated | Quiet |
elevenlabs-api-key-label-proseelevenlabs · benign-lookalike | Must not flagT3 · Project policy | Quiet |
elevenlabs-api-key-long-body-twinelevenlabs · unsettled-evidence-input | Pending reviewT0 · Pending · twin | Unscored |
elevenlabs-api-key-maskelevenlabs · benign-lookalike | Must not flagT3 · Project policy | Quiet |
elevenlabs-api-key-masked-stars-placeholderelevenlabs · documentation-placeholder | Must not flagT3 · Project policy | Quiet |
elevenlabs-api-key-missing-underscore-twinelevenlabs · prefix-near-miss | Must not flagT2 · Tool-corroborated · twin | Quiet |
elevenlabs-api-key-non-hex-body-twinelevenlabs · unsettled-evidence-input | Pending reviewT0 · Pending · twin | Unscored |
elevenlabs-api-key-pk-prefix-twinelevenlabs · prefix-near-miss | Must not flagT2 · Tool-corroborated · twin | Quiet |
elevenlabs-api-key-prefix-onlyelevenlabs · benign-lookalike | Must not flagT2 · Tool-corroborated | Quiet |
elevenlabs-api-key-referenceelevenlabs · benign-lookalike | Must not flagT3 · Project policy | Quiet |
elevenlabs-api-key-residency-hosts-proseelevenlabs · prose-mention | Must not flagT3 · Project policy | Quiet |
elevenlabs-api-key-short-bodyelevenlabs · benign-lookalike | Must not flagT2 · Tool-corroborated | Quiet |
elevenlabs-api-key-short-body-twinelevenlabs · unsettled-evidence-input | Pending reviewT0 · Pending · twin | Unscored |
elevenlabs-api-key-unprefixed-hex-near-misselevenlabs · format-near-miss | Must not flagT2 · Tool-corroborated | Quiet |
elevenlabs-api-key-voice-id-public-idelevenlabs · public-identifier | Must not flagT2 · Tool-corroborated | Quiet |
elevenlabs-api-key-your-api-key-placeholderelevenlabs · documentation-placeholder | Must not flagT3 · Project policy | Quiet |