Netlify personal access tokens

• Provider documentation 2023-11-07 nf-prefixed token format · observed 2026-09-23 · Netlify's staff-authored announcement states "All Netlify authentication tokens will start with a nf prefix followed by a single identifying character" — nfp for personal access tokens (nfc/nfo/nfu/nfb for CLI, OAuth, app and build tokens) — and that token storage capacity must grow "to 40 characters"; the "_" delimiter and the [A-Za-z0-9_] body alphabet are tool-corroborated, not stated on the page
• trufflehog 3.97.4
• gitleaks 8.30.1

Netlify's API guide (docs.netlify.com/api-and-cli-guides/api-guides/get-started-with-api/) documents only how a personal access token is created and sent as a Bearer header; the prefix and 40-character total come from the provider's own token-format announcement, hosted on answers.netlify.com and written by Netlify staff. trufflehog 3.97.4's netlify/v2 detector pins exactly `\b(nfp_[a-zA-Z0-9_]{36})\b`, but only after a `netlify` keyword (PrefixRegex); gitleaks 8.30.1's netlify-access-token rule fixes no prefix at all — a keyword-plus-assignment-gated 40–46-byte body over [a-z0-9=_\-], matched case-insensitively — so it corroborates only that a 40-byte nfp_ token in a netlify assignment is recognized, never the prefix. This contract, like the product, needs no keyword: the provider-documented prefix and exact length are self-identifying, so a bare token is a positive here and an expected false negative for both peers; the keyword-context positive records what each peer does when the keyword is present. The announcement itself states pre-2023-11 unprefixed tokens "will be unaffected"; that legacy shape (trufflehog's keyword-gated netlify/v1, gitleaks's keyword-gated 40–46-byte body) is shared by every pre-change Netlify token class, so it has no contract here, and the other four prefixed classes (nfc_/nfo_/nfu_/nfb_) are separate credentials outside this personal-access-token family. Build-hook URLs and site/account/deploy ids are out of scope. redact-secret#311 (PR #666) froze the identical grammar on the product side.