For anyone whose API hands out keys
Key ShapeCheck your API key design before a key leaks - then plan the day one does.
Describe your keys and paste a few test keys. Your browser checks the prefix and its environment marker, the body's entropy against the 120-bit floor, verifies each key's checksum, checks that secret scanners could find them, ranks storage and scoping from a short interview, and runs the rotation, dashboard, offboarding and OWASP API2 checks. The keys you paste never leave this page - not sent with a run, not saved. Then the key design, and the runbook.
The platform, and a short interview free
The key format, and a few test keys free
Storage, rotation and the rest of the lifecycle free
The checks free
What the page flags
Your test keys, masked
Area by area
A scanner pattern for your keys free
The pattern a secret-scanning program needs to find your keys in public code.
Pattern
The key design metered
Pricing as soon as the session is ready...
Sign inThe reply could not be read. Here it is as it came back:
Caveats
Caveats
The page's check of this reply
Saved designs
How it works - and what is sourced
The format follows the skill: a type-and-environment prefix ending in _, a random body of at least 120 bits (length times log2 of the alphabet - a 30-character base62 body is about 178 bits), and a checksum so validators reject malformed keys without a lookup and scanners filter noise. This page's checksum scheme is the CRC32 of the body written as 6 base62 characters; it verifies every test key you paste, in your browser, and generates fresh ones with the browser's cryptographic random source. Pasted keys are never sent with a run, never saved, and shown masked.
The rankings follow the skill: hash-only storage by default, retrievable (KMS-encrypted) only when consumers routinely lose low-stakes keys, workload identity for CI and AI agents; per-environment keys with coarse restrictive scopes by default, fine-grained scopes for compliance, several teams or a long mandate. The other checks are the skill's rotation mechanics (one atomic roll, two active keys, 1-7 days of routine grace, none on compromise), the four self-service actions, ownership tiers and offboarding, governance evidence, and the OWASP API2 failure modes.