Skip to content
Benchmarks

redact-secret · Report

API key

fw_-prefixed API key; 22- and 24-character bodies are observed, not documented.

  • Fireworks AI
  • Detectors: fireworks-ai-api-key
  • Run 2026-10-07
  • Mode published · redact-secret 0.1.0-beta.14
All providers
  • Dossier verdictReady
  • Dossier evidence levelT1 · Provider-documented
  • Dossier researched2026-09-24
Registry detector fireworks-ai-api-key since redact-secret#730 (registry pinned at f2082ab); graduated from a Beta.8 arrival family (#212, research #227), contract in benchmarks/lib/beta8/212.ts. The fpk_ Fire Pass key and any unprefixed legacy key are not covered.

Research record

From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.
  • Review stateDraft, not reviewed
  • Format revision1 · current
  • ResearchResearched
  • Researched2026-09-24

3 events in the review history: 2 observed, 1 reviewed. Latest: observed on 2026-09-24 by automation, project maintainer. Project-maintained review is not independent validation. The family record at this release.

Format

Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.

What it looks like

Descriptive pattern
^fw_(?:[A-Za-z0-9]{22}|[A-Za-z0-9]{24})$

Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.

Format facts

  • Provider documented · provider-source · current · observed 2026-09-24

    fw_-prefixed API key: the provider documents only the fw_ prefix (examples are truncated); no body length or alphabet is stated

  • Provider documented · field-prefix · current · observed 2026-09-24

    prefix: fw_ (lowercase, underscore)

  • Provider documented · field-prefix-validation · current · observed 2026-09-24

    prefix validation: provider tooling accepts a key only if it starts with fw_ or fpk_ (case-sensitive)

  • Unresolved · field-body-length · current · observed 2026-09-24

    body length: 22 or 24 characters (25 or 27 total) (Separate observed hypotheses; not a negative boundary.)

  • Unresolved · field-body-alphabet · current · observed 2026-09-24

    body alphabet: [A-Za-z0-9]; observed values avoided 0/O/I/l (base58-consistent) (The base58 reading is an inference; positives stay base58-consistent and no twin mutates the alphabet.)

  • Unresolved · field-fpk-fire-pass-key · current · observed 2026-09-24

    fpk_ Fire Pass key: documented second prefix under the same env var; body grammar unknown

    • docs.fireworks.ai/firepassprovider-documentation · last read 2026-09-24 · latest outcome read · supports fpk_ Fire Pass key: documented second prefix under the same env var; body grammar unknown

  • Unresolved · field-unprefixed-legacy-key · current · observed 2026-09-24

    unprefixed legacy key: possible older unprefixed format (GitGuardian "Not prefixed")

  • Unresolved · listed-references · current · observed 2026-09-24

    The legacy contract lists 2 references without stating which property each supports.

    • docs.fireworks.ai/firepassprovider-documentation · last read 2026-09-24 · latest outcome read · supports Listed as a reference by the legacy contract
    • github.com/fw-ai/fireconnectother · last read 2026-09-24 · latest outcome read · supports Listed as a reference by the legacy contract

  • Provider documented · dossier-research · current · observed 2026-09-24

    Legacy dossier research (verdict ready, tier T1) cited 3 sources; the dossier does not attribute sources to individual properties.

  • Provider documented · taxonomy-sources · current · observed 2026-09-24

    The legacy taxonomy lists 1 source for this family. The taxonomy records no date; the dossier researchedAt is used as the observed-at date.

Open questions

No open question is recorded for this revision.

Benchmark dossier notes

From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.
Shape
prefix fw_ followed by 22 or 24 letters and digits (25 or 27 in total). Provider docs write the key as fw_... and never state a length or alphabet. Of nine distinct public non-placeholder values, six had 22-character and three 24-character bodies; none contained 0, O, I or l, which is consistent with base58 but not documented. Community rules that require 30 or more characters would miss all nine.
Basis
T1 for the prefix (provider docs and provider code). Widths and alphabet: maintainer observation report only. No TruffleHog, gitleaks, GitHub, betterleaks or Kingfisher rule exists for this prefix.
Issuance
not attempted. Console or firectl, with a short expiry; several keys would show whether the length varies (checklist in benchmarks#227).
Contract in core
detector-families.md (frozen in the #726 record: the two widths are positive hypotheses, so no other width is a negative rule beyond the exact match).

In this benchmark

Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.
Fixtures
32
Left readable
0
Redacted too much
0
False alarms
0

32 fixtures: 11 expect a redaction, 21 must stay quiet. See every row

redact-secret fixture counts by evidence level
Evidence levelFixturesLeft readableToo muchFalse alarms
T1Provider-documented11000
T2Tool-corroborated12000
T3Project policy9000

Every scanner on the same fixtures

In run order. Counts are what each scanner recorded on this family's fixtures, whichever rules it has; a scanner with no rule for the family has nothing to report on it.

Counts per scanner on this family's fixtures
ScannerFixturesLeft readableToo muchFalse alarms
flare-redactRuntime library · 1.6.1 · Published npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engineNo rule maps to it321010
gitleaksRepository scanner · 8.30.1 · Directory scan · default rulesNo rule maps to it32401
redact-secretProduct measured here · 0.1.0-beta.14 · Published npm package · default detectors1 detector mapped32000
trufflehogRepository scanner · 3.97.4 · Filesystem scan · verification disabledNo rule maps to it321100

Benchmark dossier questions

Things the sources do not settle. They are listed so nobody reads them as settled.
Open caveat
T1 on the fw_ prefix only; the 22 and 24 character widths and the alphabet come from a nine-sample maintainer observation and are provisional positive hypotheses (checklist in benchmarks#227).

Looks like it, but isn't

Values the dossier records as resembling this credential without being one.
Collisions
fpk_ Fire Pass keys share FIREWORKS_API_KEY and are a separate live prefix; unprefixed older keys may exist (GitGuardian says "not prefixed"). Non-secret: keyId, the prefix display value, account ids, model paths (accounts/fireworks/models/...), service-account emails, and fw_id, fw_version, fw_spec style identifiers. A keychain reference written by fireconnect is not a key.

Scanner rules for this family

Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.

No peer rule maps to this family

None of the reviewed peer scanners has a rule that can match a credential of this family.

None mapped

32 of 32 rows

Fixtures in this family

32 rows, redact-secret's outcome on each. Rows that need a look come first (0), then the rest in corpus order. Choose "Every scanner" to see each scanner's outcome for the same rows.
Fixtures in API key
FixtureKind and evidenceredact-secret
fireworks-ai-api-key-bearer-curlfireworks-ai · documented-format-literalMust redactT1 · Provider-documentedRedacted
fireworks-ai-api-key-dotenvfireworks-ai · documented-format-literalMust redactT1 · Provider-documentedRedacted
fireworks-ai-api-key-firectl-flagfireworks-ai · documented-format-literalMust redactT1 · Provider-documentedRedacted
fireworks-ai-api-key-key-shape-barefireworks-ai · documented-format-literalMust redactT1 · Provider-documentedRedacted
fireworks-ai-api-key-key-shape-quotedfireworks-ai · documented-format-literalMust redactT1 · Provider-documentedRedacted
fireworks-ai-api-key-key-shape-unicode-crlffireworks-ai · documented-format-literalMust redactT1 · Provider-documentedRedacted
fireworks-ai-api-key-letter-prefix-twinfireworks-ai · prefix-near-missMust not flagT2 · Tool-corroborated · twinQuiet
fireworks-ai-api-key-litellm-exportfireworks-ai · documented-format-literalMust redactT1 · Provider-documentedRedacted
fireworks-ai-api-key-litellm-yamlfireworks-ai · documented-format-literalMust redactT1 · Provider-documentedRedacted
fireworks-ai-api-key-python-clientfireworks-ai · documented-format-literalMust redactT1 · Provider-documentedRedacted
fireworks-ai-api-key-vercel-ai-sdkfireworks-ai · documented-format-literalMust redactT1 · Provider-documentedRedacted
fireworks-ai-api-key-x-fireworks-headerfireworks-ai · documented-format-literalMust redactT1 · Provider-documentedRedacted
fireworks-ai-api-key-account-and-model-public-idfireworks-ai · public-identifierMust not flagT2 · Tool-corroboratedQuiet
fireworks-ai-api-key-base64-account-encoded-valuefireworks-ai · benign-encoded-valueMust not flagT2 · Tool-corroboratedQuiet
fireworks-ai-api-key-console-prefix-placeholderfireworks-ai · documentation-placeholderMust not flagT3 · Project policyQuiet
fireworks-ai-api-key-docs-placeholder-placeholderfireworks-ai · documentation-placeholderMust not flagT3 · Project policyQuiet
fireworks-ai-api-key-ellipsis-placeholderfireworks-ai · documentation-placeholderMust not flagT3 · Project policyQuiet
fireworks-ai-api-key-firmware-version-near-missfireworks-ai · format-near-missMust not flagT2 · Tool-corroboratedQuiet
fireworks-ai-api-key-hyphen-delimiter-twinfireworks-ai · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
fireworks-ai-api-key-key-guidance-prosefireworks-ai · prose-mentionMust not flagT3 · Project policyQuiet
fireworks-ai-api-key-keychain-reference-referencefireworks-ai · templated-referenceMust not flagT3 · Project policyQuiet
fireworks-ai-api-key-label-prosefireworks-ai · benign-lookalikeMust not flagT3 · Project policyQuiet
fireworks-ai-api-key-maskfireworks-ai · benign-lookalikeMust not flagT3 · Project policyQuiet
fireworks-ai-api-key-missing-delimiter-twinfireworks-ai · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
fireworks-ai-api-key-prefix-onlyfireworks-ai · benign-lookalikeMust not flagT2 · Tool-corroboratedQuiet
fireworks-ai-api-key-referencefireworks-ai · benign-lookalikeMust not flagT3 · Project policyQuiet
fireworks-ai-api-key-sdk-environ-referencefireworks-ai · templated-referenceMust not flagT3 · Project policyQuiet
fireworks-ai-api-key-service-account-public-idfireworks-ai · public-identifierMust not flagT2 · Tool-corroboratedQuiet
fireworks-ai-api-key-short-bodyfireworks-ai · benign-lookalikeMust not flagT2 · Tool-corroboratedQuiet
fireworks-ai-api-key-transposed-prefix-twinfireworks-ai · prefix-near-missMust not flagT2 · Tool-corroborated · twinQuiet
fireworks-ai-api-key-uppercase-prefix-twinfireworks-ai · prefix-near-missMust not flagT2 · Tool-corroborated · twinQuiet
fireworks-ai-api-key-workflow-ids-near-missfireworks-ai · format-near-missMust not flagT2 · Tool-corroboratedQuiet

Sources

Researched 2026-09-24.

Documentation and code

Research log