Heroku API tokens

• Provider documentation HRKU- prefixed OAuth access token (41-character 2024-04 and 65-character 2025-04 generations) · observed 2026-09-23 · the page states "Heroku OAuth access tokens are 65 characters long and prefixed with HRKU-" and shows a 65-character worked example beginning HRKU-AA (not reproduced here, since secret scanners classify it as a live token); its own response examples, changelog-items/2842 and changelog-items/3175 ("increasing from 41 characters to 65 characters") document the earlier 41-character HRKU-<uuid> generation. The literal AA after the dash is example- and tool-observed and the [A-Za-z0-9_-] body alphabet is tool-corroborated; neither is stated in prose
• gitleaks 8.30.1
• trufflehog 3.97.4

Re-checked 2026-09-24 (#235, consumed by #209). Heroku documents three generations of the OAuth access token, each "continue[s] to work … until they're regenerated": G0, a bare UUID granted before 2024-04-01 (changelog-items/2842), which is the separate context-gated heroku-api-key-legacy contract; G1, HRKU- plus a UUID, 41 characters, granted 2024-04-01 through 2025-04-22 (changelog-items/2842, 2800, 3175; the oauth article's own response examples and heroku/cli's generated types still show it); and G2, HRKU- plus 60 characters, 65 in total, granted from 2025-04-23 (changelog-items/3175, 3176). An earlier revision of this contract called G1 an "undocumented-width variant"; the provider names 41 as the previous length, so `pattern` now accepts both HRKU- generations. The two pinned tools cover only G2: gitleaks 8.30.1's heroku-api-key-v2 rule (`\b((HRKU-AA[0-9a-zA-Z_-]{58}))`, keyword hrku-aa, entropy 4, trailing delimiter) and trufflehog 3.97.4's heroku/v2 detector both match exactly HRKU-AA plus 58 bytes of [A-Za-z0-9_-]; a G1 token is an expected false negative for both (GitLab's rule, not pinned, covers G1 only). The AA start of G2 is kept in `pattern` as observed grammar (the provider's worked examples and both pinned tools), not as provider-stated grammar: trufflehog#4510 disputes it and osv-scalibr does not pin it, so no fixture asserts silence on a non-AA 65-character value. The authentication article's 40-character hex .netrc example is an undated fourth shape recorded unresolved. Refresh tokens, client secrets, grant codes and session tokens are bare UUIDs and secrets that no family claims; they are never benign controls here. redact-secret#312 (PR #675) froze the G2 grammar only on the product side.