Skip to content
Benchmarks

redact-secret · Report

Admin API key (sk-admin-)

sk-admin- prefixed organization admin key with the T3BlbkFJ marker between two 58- or 74-byte segments; a marker-less body is out of contract.

  • OpenAI
  • Detectors: openai-admin-api-key
  • Run 2026-10-07
  • Mode published · redact-secret 0.1.0-beta.14
All providers
  • Dossier verdictReady
  • Dossier evidence levelT2 · Tool-corroborated
  • Dossier researched2026-09-29
Beta.10 arrival family openai-admin-api-key (#384, research redact-secret#777, product #863, #882). openai-token already recognises sk-admin-; since product PR #882 (redact-secret#774) it reports its own openai_admin_api_key finding type (previously the shared openai_api_key type), so it is scored on its own arrival id by finding type rather than borrowing the status of openai:secret-api-key. T2.

Research record

From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.
  • Review stateDraft, not reviewed
  • Format revision1 · current
  • ResearchResearched
  • Researched2026-09-29

3 events in the review history: 2 observed, 1 reviewed. Latest: observed on 2026-09-29 by automation, project maintainer. Project-maintained review is not independent validation. The family record at this release.

Format

Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.

What it looks like

Descriptive pattern
^sk-admin-[A-Za-z0-9_-]{58}T3BlbkFJ[A-Za-z0-9_-]{58}$

Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.

Format facts

Open questions

No open question is recorded for this revision.

Benchmark dossier notes

From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.
Shape
prefix sk-admin-, then 58 or 74 characters of [A-Za-z0-9_-], the marker T3BlbkFJ, then 58 or 74 more. The three gitleaks admin vectors are all 58/58 (133 characters). A marker-less body of any length is unevidenced and out of contract, including the 124-character body in a trufflehog feature request, which equals 58 + 8 + 58.
Basis
T2. Provider evidence is family-level only: the Admin API guide states scope (admin keys cannot call non-administration endpoints, env var OPENAI_ADMIN_KEY), and openai/codex names sk-admin- and the watermark. gitleaks 8.30.1 requires the marker on admin keys. trufflehog 3.97.4 does not exclude admin keys: PR #4689 (2026-02-11) moved them out of the generic openai detector into a dedicated openaiadmin detector that requires the marker and exactly 58/58 (an earlier reading of this dossier called it an exclusion; corrected by redact-secret#1013). nuclei-templates and poltergeist also match 58 + marker + 58. With openai/codex that is 5 references, 5 owners and 2 non-summary classes for the 58/58 shape, recorded in empirical-observations.json. GitGuardian has a dedicated detector with no length stated.
Issuance
not attempted. Organization owners create admin keys under organization settings; the checklist (prefix, two segment widths, marker offset, alphabet, shown once) is in the #777 research comment.
Contract in core
detector-families.md. #863 reconciled the precision contract (previously pending, T0) with the detector. Product PR #882 gave admin keys their own finding type.

In this benchmark

Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.
Fixtures
43
Left readable
0
Redacted too much
0
False alarms
0

43 fixtures: 19 expect a redaction, 24 must stay quiet. See every row

redact-secret fixture counts by evidence level
Evidence levelFixturesLeft readableToo muchFalse alarms
T2Tool-corroborated35000
T3Project policy8000

Every scanner on the same fixtures

In run order. Counts are what each scanner recorded on this family's fixtures, whichever rules it has; a scanner with no rule for the family has nothing to report on it.

Counts per scanner on this family's fixtures
ScannerFixturesLeft readableToo muchFalse alarms
flare-redactRuntime library · 1.6.1 · Published npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engineNo rule maps to it431635
gitleaksRepository scanner · 8.30.1 · Directory scan · default rules1 rule targets it43103
redact-secretProduct measured here · 0.1.0-beta.14 · Published npm package · default detectors1 detector mapped43000
trufflehogRepository scanner · 3.97.4 · Filesystem scan · verification disabled1 rule targets it43100

Benchmark dossier questions

Things the sources do not settle. They are listed so nobody reads them as settled.
Open caveat
No provider page states an admin-key length or alphabet, so T1 is unreachable. 58/58 rests on four peer owners; no source anywhere shows a 74/74 admin value, which gitleaks admits only through the width union it shares with sk-proj-/sk-svcacct-. As #1013 recommends, the benchmark claim is 58/58 only and no fixture asserts 74/74 either way (bounded in the ledger); the product keeps accepting 74/74.

Looks like it, but isn't

Values the dossier records as resembling this credential without being one.
Collisions
shares the sk- namespace and marker grammar with sk-proj- and sk-svcacct-. The admin key resource id is not the secret. Blogs conflate 164-character project widths and {40,} bounds with admin.

Scanner rules for this family

Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.
Peer scanner rules that target this family
ScannerRuleWhat the rule matches
gitleaks · rules 8.30.1openai-api-keysk-proj-, sk-svcacct- or sk-admin- with the T3BlbkFJ marker
trufflehog · rules 3.97.4openaiadminsk-admin- + 58 + T3BlbkFJ + 58

No rule maps to this family in flare-redact, openredaction.

43 of 43 rows

Fixtures in this family

43 rows, redact-secret's outcome on each. Rows that need a look come first (0), then the rest in corpus order. Choose "Every scanner" to see each scanner's outcome for the same rows.
Fixtures in Admin API key (sk-admin-)
FixtureKind and evidenceredact-secret
openai-admin-api-key-actions-usage-exportopenai · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
openai-admin-api-key-admn-prefix-twinopenai · prefix-near-missMust not flagT2 · Tool-corroborated · twinQuiet
openai-admin-api-key-compose-envopenai · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
openai-admin-api-key-config-tomlopenai · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
openai-admin-api-key-curl-beareropenai · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
openai-admin-api-key-dotenvopenai · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
openai-admin-api-key-exportopenai · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
openai-admin-api-key-first-segment-57-twinopenai · wrong-lengthMust not flagT2 · Tool-corroborated · twinQuiet
openai-admin-api-key-gitlab-ci-variablesopenai · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
openai-admin-api-key-go-constopenai · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
openai-admin-api-key-json-configopenai · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
openai-admin-api-key-key-digest-encoded-valueopenai · benign-encoded-valueMust not flagT2 · Tool-corroboratedQuiet
openai-admin-api-key-lowercase-marker-twinopenai · wrong-alphabetMust not flagT2 · Tool-corroborated · twinQuiet
openai-admin-api-key-markerless-test-name-near-missopenai · format-near-missMust not flagT2 · Tool-corroboratedQuiet
openai-admin-api-key-oncall-handoffopenai · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
openai-admin-api-key-powershell-envopenai · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
openai-admin-api-key-prefix-only-near-missopenai · format-near-missMust not flagT2 · Tool-corroboratedQuiet
openai-admin-api-key-python-requests-headersopenai · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
openai-admin-api-key-python-sdkopenai · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
openai-admin-api-key-requests-debugopenai · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
openai-admin-api-key-short-second-segment-twinopenai · wrong-lengthMust not flagT2 · Tool-corroborated · twinQuiet
openai-admin-api-key-tfvars-admin-keyopenai · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
openai-admin-api-key-tool-callopenai · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
openai-admin-api-key-ts-clientopenai · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
openai-admin-api-key-usage-cli-flagopenai · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
openai-admin-api-key-usage-logopenai · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
openai-admin-api-key-actions-secret-referenceopenai · templated-referenceMust not flagT3 · Project policyQuiet
openai-admin-api-key-admin-keys-listing-public-idopenai · public-identifierMust not flagT2 · Tool-corroboratedQuiet
openai-admin-api-key-console-mask-placeholderopenai · documentation-placeholderMust not flagT3 · Project policyQuiet
openai-admin-api-key-docs-ellipsis-placeholderopenai · documentation-placeholderMust not flagT3 · Project policyQuiet
openai-admin-api-key-embedded-leading-twinopenai · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
openai-admin-api-key-env-reference-referenceopenai · templated-referenceMust not flagT3 · Project policyQuiet
openai-admin-api-key-inside-identifier-near-missopenai · format-near-missMust not flagT2 · Tool-corroboratedQuiet
openai-admin-api-key-key-resource-public-idopenai · public-identifierMust not flagT2 · Tool-corroboratedQuiet
openai-admin-api-key-marker-fk-twinopenai · prefix-near-missMust not flagT2 · Tool-corroborated · twinQuiet
openai-admin-api-key-marker-less-body-twinopenai · wrong-alphabetMust not flagT2 · Tool-corroborated · twinQuiet
openai-admin-api-key-org-and-project-public-idopenai · public-identifierMust not flagT2 · Tool-corroboratedQuiet
openai-admin-api-key-permissions-paragraph-proseopenai · prose-mentionMust not flagT3 · Project policyQuiet
openai-admin-api-key-prefix-guidance-proseopenai · prose-mentionMust not flagT3 · Project policyQuiet
openai-admin-api-key-secrets-manager-arn-referenceopenai · templated-referenceMust not flagT3 · Project policyQuiet
openai-admin-api-key-short-first-segment-twinopenai · wrong-lengthMust not flagT2 · Tool-corroborated · twinQuiet
openai-admin-api-key-underscore-delimiter-twinopenai · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
openai-admin-api-key-your-key-here-placeholderopenai · documentation-placeholderMust not flagT3 · Project policyQuiet

Sources

Researched 2026-09-29.

Documentation and code

  • github.com/openai/codex/blob/418199f6ade4f9018b1f0b455a685387a811ad2e/codex-rs/network-proxy/src/credential_broker/providers/openai.rs#L13-L23
  • github.com/gitleaks/gitleaks/blob/v8.30.1/config/gitleaks.toml
  • developers.openai.com/api/docs/guides/admin-apis
  • github.com/trufflesecurity/trufflehog/blob/363923b901c911a9164f50b6c423f47c15372b1c/pkg/detectors/openaiadmin/openaiadmin.go#L26-L29
  • github.com/gitleaks/gitleaks/blob/83d9cd684c87d95d656c1458ef04895a7f1cbd8e/cmd/generate/config/rules/openai.go#L14
  • github.com/projectdiscovery/nuclei-templates/blob/02b06eb813310376e9a29543fd63a53f0dd3d4b3/http/exposures/tokens/openai/openai-admin-api-key.yaml#L23
  • github.com/ghostsecurity/poltergeist/blob/e071ca2d15f652c6e87e63a64716144a9383c3b2/pkg/rules/openai.yaml#L36

Research log

Other OpenAI families