redact-secret · Report
API key
pplx--prefixed API key; the 48-character alphanumeric body is tool-corroborated, not provider-stated.
Registry detector perplexity-api-key since redact-secret#730 (registry pinned at f2082ab); graduated from a Beta.8 arrival family (#212, research #226), contract in benchmarks/lib/beta8/212.ts.
Research record
From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.
4 events in the review history: 3 observed, 1 reviewed. Latest: observed on 2026-10-03 by automation, project maintainer. Project-maintained review is not independent validation. The family record at this release.
Format
Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.
What it looks like
- Descriptive pattern
^pplx-[A-Za-z0-9]{48}$
Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.
Format facts
Unresolved ·
tool-corroboration· current · observed 2026-09-24Pinned scanner rules are consistent with the contract grammar (1 artifact: gitleaks 8.30.1).
- gitleaks/gitleaks @ v8.30.1: config/gitleaks.tomlscanner-rule-source · last read 2026-10-04 · latest outcome read · supports gitleaks 8.30.1: gitleaks.toml
Provider documented ·
field-prefix· current · observed 2026-09-24prefix: pplx- (lowercase, one dash)
- docs.perplexity.ai/docs/admin/api-key-managementprovider-documentation · last read 2026-10-03 · latest outcome unchanged · supports auth_token response field shown with a pplx- value; the example body is a shortened placeholder
Tool corroborated ·
field-body-length· current · observed 2026-09-24body length: exactly 48 characters after the prefix (53 total) (Tool-corroborated, not provider-stated. flare-redact perplexity_key uses {40,60}; the 47/49 twins record the peer difference, not a provider exclusion.)
- gitleaks/gitleaks @ v8.30.1: config/gitleaks.tomlscanner-rule-source · last read 2026-10-04 · latest outcome read · supports perplexity-api-key: pplx-[a-zA-Z0-9]{48}
- google/osv-scalibr @ main: veles/secrets/perplexityapikey/detector.goscanner-rule-source · last read 2026-09-24 · latest outcome read · supports maxTokenLength 53; probably shares lineage with gitleaks
Unresolved ·
field-body-alphabet· current · observed 2026-09-24body alphabet: [A-Za-z0-9] (No provider statement; the official pplx CLI accepts any printable ASCII.)
- gitleaks/gitleaks @ v8.30.1: config/gitleaks.tomlscanner-rule-source · last read 2026-10-04 · latest outcome read · supports body alphabet: [A-Za-z0-9]
Unresolved ·
field-analytics-key-and-mcp-oauth-token-shapes· current · observed 2026-09-24analytics-key and MCP OAuth token shapes: undocumented; may or may not share pplx-
- docs.perplexity.ai/docs/admin/computer-analytics-apiprovider-documentation · last read 2026-09-24 · latest outcome read · supports analytics-key and MCP OAuth token shapes: undocumented; may or may not share pplx-
Unresolved ·
field-checksum-embedded-project-id-historical-versions· current · observed 2026-09-24checksum, embedded project id, historical versions: none documented; pre-2025-04 and pre-2026-04 key shapes unknown
- github.com/redact-secret/redact-secret-benchmarks/issues/226other · last read 2026-09-24 · latest outcome read · supports checksum, embedded project id, historical versions: none documented; pre-2025-04 and pre-2026-04 key shapes unknown
Unresolved ·
dossier-research· current · observed 2026-09-24Legacy dossier research (verdict ready, tier T2) cited 2 sources; the dossier does not attribute sources to individual properties.
- docs.perplexity.ai/docs/admin/api-key-managementprovider-documentation · last read 2026-10-03 · latest outcome unchanged · supports Cited by the legacy dossier research for this family
- redact-secret/redact-secret @ 8b6a5fde52ecb4dfce13f09c7a947062d21483c7: docs/audits/evidence/726/README.mdproject-research-note · last read 2026-09-27 · latest outcome read · supports Final research evidence recorded by the legacy dossier
Unresolved ·
taxonomy-sources· current · observed 2026-09-24The legacy taxonomy lists 1 source for this family. The taxonomy records no date; the dossier researchedAt is used as the observed-at date.
- docs.perplexity.ai/docs/admin/api-key-managementprovider-documentation · last read 2026-10-03 · latest outcome unchanged · supports Listed as a source for this family in the legacy taxonomy
Open questions
No open question is recorded for this revision.
Benchmark dossier notes
From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.
- Shape
- prefix
pplx-followed by 48 letters and digits (53 in total). The provider's rotation docs show applx-value but with an obviously shortened body, and never state a length or alphabet. Gitleaks (2025-04) and osv-scalibr say exactly 48 alphanumeric; flare-redact allows 40 to 60; one redaction rule allows 10 or more with_and-. The official CLI validates only that a key is non-empty printable ASCII. - Basis
- T2. The prefix is provider documentation; the body is scanner rules. No provider staff statement on length was found.
- Issuance
- not attempted; a project may need billing set up first. The console checklist is in benchmarks#226.
- Contract in core
- detector-families.md (frozen in the #726 record, implemented under #730).
In this benchmark
Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.
- Fixtures
- 41
- Left readable
- 0
- Redacted too much
- 0
- False alarms
- 0
41 fixtures: 18 expect a redaction, 23 must stay quiet. See every row
| Evidence level | Fixtures | Left readable | Too much | False alarms |
|---|---|---|---|---|
| T1Provider-documented | 2 | 0 | 0 | 0 |
| T2Tool-corroborated | 29 | 0 | 0 | 0 |
| T3Project policy | 10 | 0 | 0 | 0 |
Every scanner on the same fixtures
In run order. Counts are what each scanner recorded on this family's fixtures, whichever rules it has; a scanner with no rule for the family has nothing to report on it.
| Scanner | Fixtures | Left readable | Too much | False alarms |
|---|---|---|---|---|
| flare-redactRuntime library · 1.6.1 · Published npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engine1 rule targets it | 41 | 0 | 3 | 2 |
| gitleaksRepository scanner · 8.30.1 · Directory scan · default rules1 rule targets it | 41 | 0 | 0 | 1 |
| redact-secretProduct measured here · 0.1.0-beta.14 · Published npm package · default detectors1 detector mapped | 41 | 0 | 0 | 0 |
| trufflehogRepository scanner · 3.97.4 · Filesystem scan · verification disabledNo rule maps to it | 41 | 18 | 0 | 0 |
Benchmark dossier questions
Things the sources do not settle. They are listed so nobody reads them as settled.
- Open caveat
- The provider shows the pplx- prefix but no length or alphabet; the 48-character alphanumeric body is scanner-only and two of the scanners likely share lineage (checklist in benchmarks#226).
Looks like it, but isn't
Values the dossier records as resembling this credential without being one.
- Collisions
- model ids (
pplx-7b-online,pplx-embed-v1-4b), package and command names (pplx-cli,pplx-api), hostnames such aspplx-res.cloudinary.comand*.pplx.app, and an OpenRouter key stored underPERPLEXITY_API_KEY. GitGuardian marks the type "not prefixed", which contradicts the other sources.
Scanner rules for this family
Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.
| Scanner | Rule | What the rule matches |
|---|---|---|
| flare-redact · rules 1.6.1 | perplexity_key | pplx- + 40-60 characters |
| gitleaks · rules 8.30.1 | perplexity-api-key | pplx- + 48 alphanumerics |
No rule maps to this family in openredaction, trufflehog.
Fixtures in this family
41 rows, redact-secret's outcome on each. Rows that need a look come first (0), then the rest in corpus order. Choose "Every scanner" to see each scanner's outcome for the same rows.
| Fixture | Kind and evidence | redact-secret |
|---|---|---|
perplexity-api-key-actions-envperplexity · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
perplexity-api-key-bearer-curlperplexity · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
perplexity-api-key-chat-messageperplexity · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
perplexity-api-key-cli-credentialsperplexity · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
perplexity-api-key-compose-envperplexity · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
perplexity-api-key-curl-chatperplexity · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
perplexity-api-key-debug-logperplexity · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
perplexity-api-key-dotenvperplexity · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
perplexity-api-key-key-shape-bareperplexity · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
perplexity-api-key-key-shape-quotedperplexity · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
perplexity-api-key-key-shape-unicode-crlfperplexity · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
perplexity-api-key-long-body-twinperplexity · wrong-length | Must not flagT3 · Project policy · twin | Quiet |
perplexity-api-key-mcp-configperplexity · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
perplexity-api-key-pplx-exportperplexity · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
perplexity-api-key-python-clientperplexity · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
perplexity-api-key-revoke-payloadperplexity · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
perplexity-api-key-secret-printperplexity · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
perplexity-api-key-short-body-twinperplexity · wrong-length | Must not flagT2 · Tool-corroborated · twin | Quiet |
perplexity-api-key-short-body-twin-wrong-lengthperplexity · wrong-length | Must not flagT2 · Tool-corroborated · twin | Quiet |
perplexity-api-key-twin-base-dotenvperplexity · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
perplexity-api-key-twin-base-pythonperplexity · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
perplexity-api-key-base-url-and-name-public-idperplexity · public-identifier | Must not flagT3 · Project policy | Quiet |
perplexity-api-key-base64-model-encoded-valueperplexity · benign-encoded-value | Must not flagT1 · Provider-documented | Quiet |
perplexity-api-key-docs-placeholder-placeholderperplexity · documentation-placeholder | Must not flagT3 · Project policy | Quiet |
perplexity-api-key-embedding-model-public-idperplexity · public-identifier | Must not flagT1 · Provider-documented | Quiet |
perplexity-api-key-env-reference-referenceperplexity · templated-reference | Must not flagT3 · Project policy | Quiet |
perplexity-api-key-inner-dash-twinperplexity · wrong-alphabet | Must not flagT2 · Tool-corroborated · twin | Quiet |
perplexity-api-key-key-guidance-proseperplexity · prose-mention | Must not flagT3 · Project policy | Quiet |
perplexity-api-key-label-proseperplexity · benign-lookalike | Must not flagT3 · Project policy | Quiet |
perplexity-api-key-maskperplexity · benign-lookalike | Must not flagT3 · Project policy | Quiet |
perplexity-api-key-masked-display-placeholderperplexity · documentation-placeholder | Must not flagT3 · Project policy | Quiet |
perplexity-api-key-missing-dash-twinperplexity · boundary-violation | Must not flagT2 · Tool-corroborated · twin | Quiet |
perplexity-api-key-package-name-near-missperplexity · format-near-miss | Must not flagT2 · Tool-corroborated | Quiet |
perplexity-api-key-prefix-letter-twinperplexity · prefix-near-miss | Must not flagT2 · Tool-corroborated · twin | Quiet |
perplexity-api-key-prefix-onlyperplexity · benign-lookalike | Must not flagT2 · Tool-corroborated | Quiet |
perplexity-api-key-prefix-only-near-missperplexity · format-near-miss | Must not flagT2 · Tool-corroborated | Quiet |
perplexity-api-key-referenceperplexity · benign-lookalike | Must not flagT3 · Project policy | Quiet |
perplexity-api-key-sdk-environ-referenceperplexity · templated-reference | Must not flagT3 · Project policy | Quiet |
perplexity-api-key-short-bodyperplexity · benign-lookalike | Must not flagT2 · Tool-corroborated | Quiet |
perplexity-api-key-underscore-delimiter-twinperplexity · boundary-violation | Must not flagT2 · Tool-corroborated · twin | Quiet |
perplexity-api-key-uppercase-prefix-twinperplexity · prefix-near-miss | Must not flagT2 · Tool-corroborated · twin | Quiet |
Sources
Researched 2026-09-24.
Documentation and code
- docs.perplexity.ai/docs/admin/api-key-management
Research log
- redact-secret/redact-secret-benchmarks#226Research issue
- redact-secret/redact-secret#726Research issue
- redact-secret/redact-secret#730Research issue
- Final evidence, pinned to a commit/redact-secret/redact-secret/blob/8b6a5fde52ecb4dfce13f09c7a947062d21483c7/docs/audits/evidence/726/README.md