Helicone API keys

• Provider documentation worker apiKeyRegex.ts (last changed 2025-04-29, re-checked 2026-09-28) and KeyManager.ts proxy-key builder · observed 2026-09-28 · provider validator regexes (ruling R1): sk-helicone- with optional -eu and -rl, then four 7-byte [a-z0-9] groups (43/46/49 in all); the server generator builds sk-helicone-proxy- + the same groups + - + a lowercase UUID (86 in all)
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9
• Reference 10
• Reference 11
• Reference 12

Arrival evidence (#434, product redact-secret#907; #860 handoff helicone.md, READY). The read-write key reads every logged prompt and response and administers the org. The provider validator regexes (R1) fix the prefix, segments and four 7-byte groups, the docs name the sk/pk/eu roles, and the server generator builds the proxy key. The alphabet is the provider's [a-z0-9] (R8). Excluded: the unattributable legacy bare sk- and -cp- forms (twins, since they are Helicone credentials outside the contract), -gov (unresolved, not authored) and the exact-width all-x placeholder (claimed by the contract, so neither positive nor control). Neither pinned peer has a Helicone rule. Graduated to a registry detector at the 1127bf9 re-pin (redact-secret PR #938).