PostHog tokens

• Provider documentation PERSONAL_API_KEY_PREFIX = "phx_" and generate_random_token_personal() at 658715d (re-checked 2026-09-28); docs name phx_ · observed 2026-09-28 · the docs document the phx_ personal API key; provider code and unit tests (ruling R1) fix the base57/base62 alphabet and the algorithm from which the 42–49 band is derived
• trufflehog 3.97.4
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9
• Reference 10
• Reference 11
• Reference 12

Arrival evidence (#434, product redact-secret#906; #860 handoff posthog.md, READY). A personal API key acts as the user across every organization and project the user can reach. The prefix is documented; the alphabet and algorithm are provider code and unit tests (R1); the 42–49 band is the union of the three prefixed eras (base57 48/49 since 2026-03-30, 35-byte base62 at most 48, 32-byte base62 at most 43) with the 42 floor keeping the 1.6% of 32-byte-era keys that render at 42. The phc_ project token is public and only ever a benign control. Peers lag: trufflehog 3.97.4 stops at 48 (missing the 2.9% of base57 keys at 49 and the 42-byte keys) and admits _, gitleaks 8.30.1 has no PostHog rule. Graduated to a registry detector at the 1127bf9 re-pin (redact-secret PR #938).