API key format checker
Last verified
Found a key in a log, a repo, or a config file and need to know what it is? Paste it below.
This tool runs entirely in your browser. Nothing is sent over the network, nothing is stored, and the input is cleared when you close the tab — check your network tab if you want to verify.
Even so: if this key is live, the correct first action is to revoke it, not to identify it. You only need to know what a key is when you cannot simply revoke it.
Reference
| Prefix | Provider | Type | Blast radius |
|---|---|---|---|
sk-admin- | OpenAI | Organisation admin | High — reads all billing, deletes any key |
sk-proj- | OpenAI | Project API key | Inference only |
sk-svcacct- | OpenAI | Service account key | Inference only |
sk-ant-admin | Anthropic | Admin key | High — reads billing, deactivates keys |
sk-ant-api | Anthropic | Standard API key | Inference only |
xai- | xAI | Inference key | Inference only — cannot read billing |
AIza | API key | Depends on the APIs enabled | |
gsk_ | Groq | API key | Inference |
sk-or- | OpenRouter | API key | Inference across routed providers |
r8_ | Replicate | API token | Model execution |
hf_ | Hugging Face | Access token | Depends on scopes |
The distinction that matters most is admin vs inference. A leaked inference key means someone can spend your money, bounded by your spend limit. A leaked admin key means someone can read all your billing data and delete every key in the organisation — an instant, total outage.
Which is why admin keys should never live in the same place as inference keys. OpenAI key types · Is it safe to give an app your admin key?