Secret API key

What it looks like

Descriptive pattern

^sk-(?:[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}|(?:proj|svcacct)-[A-Za-z0-9_-]{74}T3BlbkFJ[A-Za-z0-9_-]{74})$

Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.

Format facts

• Tool corroborated · tool-corroboration · current · observed 2026-09-23

  Pinned scanner rules are consistent with the contract grammar (2 artifacts: gitleaks 8.30.1; trufflehog 3.97.4).

  • gitleaks/gitleaks @ v8.30.1: config/gitleaks.tomlscanner-rule-source · last read 2026-10-04 · latest outcome read · supports gitleaks 8.30.1: gitleaks.toml
  • trufflesecurity/trufflehog @ v3.97.4: pkg/detectors/openai/openai.goscanner-rule-source · last read 2026-09-23 · latest outcome read · supports trufflehog 3.97.4: openai/openai

• Tool corroborated · dossier-research · current · observed 2026-09-23

  Legacy dossier research (verdict ready, tier T2) cited 3 sources; the dossier does not attribute sources to individual properties.

  • community.openai.com/t/1118492/2issue-or-discussion · last read 2026-09-23 · latest outcome read · supports Cited by the legacy dossier research for this family
  • openai/codex @ 418199f6ade4f9018b1f0b455a685387a811ad2e: codex-rs/network-proxy/src/credential_broker/providers/openai.rsprovider-sdk-source · last read 2026-09-29 · latest outcome read · supports Cited by the legacy dossier research for this family · #L13-L23
  • redact-secret/redact-secret @ 8b6a5fde52ecb4dfce13f09c7a947062d21483c7: docs/audits/evidence/657/README.mdproject-research-note · last read 2026-09-23 · latest outcome read · supports Final research evidence recorded by the legacy dossier

• Provider documented · provider-key-kinds · current · observed 2026-10-04

  OpenAI documentation distinguishes API keys (standard keys for application requests, including project keys that are user-owned or owned by a service account, and legacy user API keys) from Admin API keys, which are created separately and cannot be used for non-administration endpoints. This establishes the functional distinction only; no page read states a prefix, marker, length or alphabet for any of them.

  • API reference overview (authentication)provider-documentation · last read 2026-10-04 · latest outcome read · supports Create credentials: a standard API key for application requests, an Admin API key for Administration endpoints; Authentication: access through a legacy user API key is mentioned. · #authentication
  • API reference: Administration overviewprovider-documentation · last read 2026-10-04 · latest outcome read · supports Admin API keys cannot be used for non-administration endpoints.
  • Production best practices (API keys)provider-documentation · last read 2026-10-04 · latest outcome read · supports API Key Governance distinguishes service-account keys from user-owned project keys; guidance on project API keys, expiration and rotation.
  • Manage service accounts with Terraformprovider-documentation · last read 2026-10-04 · latest outcome read · supports A service account is a nonhuman identity owned by a project, and its API keys are created through the Administration API.

• Provider documented · provider-public-identifiers-and-redaction · current · observed 2026-10-04

  In OpenAI's API reference, a project API key resource carries an id (shown as key_abc), the owning project is identified by an id (proj_abc) and a service account by an id (svc_acct_abc); these identifiers are referenced in endpoints. The full key value is returned only by the creation response, and retrieval of an existing project API key returns a redacted_value (shown as sk-abc...def). This documents the identifier and redacted-display roles; it does not state a grammar for those identifiers.

  • API reference: Retrieve project API keyprovider-documentation · last read 2026-10-04 · latest outcome read · supports ProjectAPIKey: id is the identifier referenced in API endpoints; redacted_value is the redacted value of the API key; example key_abc and sk-abc...def.
  • API reference: Create project service accountprovider-documentation · last read 2026-10-04 · latest outcome read · supports Create project service account example response: service account id svc_acct_abc, key id key_abc, project proj_abc, key value shown once at creation.
  • Manage service accounts with Terraformprovider-documentation · last read 2026-10-04 · latest outcome read · supports The full API-key value is available only in the create response; later project API-key retrieval returns a redacted value.

• Provider documented · provider-example-value-not-contract-shaped · current · observed 2026-10-04

  The API reference's service-account creation example shows a key value of the form sk- followed by 18 letters and digits (sk-abcdefghijklmnop123), with no T3BlbkFJ marker and a body far shorter than any width in the descriptive pattern. The page presents it as an illustrative example response; this record does not infer from it that real keys lack the marker or have that length, nor that the value is safe to ignore.

  • API reference: Create project service accountprovider-documentation · last read 2026-10-04 · latest outcome read · supports Example response api_key.value shown as sk-abcdefghijklmnop123.

• Provider documented · provider-key-lifecycle-controls · current · observed 2026-10-04

  OpenAI's API key safety guidance (Help Center, read 2026-10-04) says project keys can be created with an expiration date after which requests from them are rejected, administrators can enforce a maximum key lifetime at the organization or project level, keys must not be deployed in client-side environments, and workload identity federation can replace a long-lived key with a short-lived access token. It states no prefix, marker, length or alphabet for any key; a missing format statement on this page is not evidence about the key shape.

  • Best Practices for API Key Safetyprovider-documentation · last read 2026-10-04 · latest outcome read · supports Project keys can be created with an expiration date after which requests from those keys will be rejected; administrators can enforce a maximum API key lifetime at the organization or project level; never deploy the key in client-side environments; workload identity federation exchanges a trusted identity for a short-lived OpenAI access token. · #2-create-api-keys-with-an-expiration-date-and-establish-a-key-rotation-process

Open questions

No open question is recorded for this revision.