Paddle API keys

• Provider documentation Paddle docs "API keys" (observed 2026-09-29): "They're 69 characters in length and always contain five underscores. You can use regex to match API keys: ^pdl_(live|sdbx)_apikey_[a-z\d]{26}_[a-zA-Z\d]{22}_[a-zA-Z\d]{3}$"; "API keys are case-sensitive"; keys created before 2025-05-06 are legacy 50-character lowercase alphanumeric strings · observed 2026-09-29 · pdl_live_apikey_ or pdl_sdbx_apikey_ + 26 [a-z0-9] + _ + 22 [A-Za-z0-9] + _ + 3 [A-Za-z0-9], 69 in all
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9

Arrival evidence (#528, product redact-secret#1033; #1014 handoff paddle.md, READY). A Paddle Billing API key is a server-side credential for a merchant-of-record account; with full permissions it reads and changes customers, subscriptions, transactions, prices and adjustments (refunds and credits). Sandbox keys act on the sandbox only and are the same family (a committed sandbox key is still a policy violation). T1 for every part: the provider docs publish the full regex and the total length, and the Node SDK mocks carry a masked key and an apikey_ id in the same layout. Excluded: legacy keys (50 [a-z0-9], no prefix; generic context covers PADDLE_API_KEY=), the apikey_ + 26 key id alone (a non-secret identifier returned by the API and in webhooks, Q5), Paddle.js client-side tokens and Paddle Classic vendor auth codes. Neither pinned peer has a Paddle rule. Graduated to a registry detector at the 4fb7882 re-pin (redact-secret PR #1039).