Skip to content
StackSiren
Free scan

Exposed API key checker

AI builders sometimes put secret keys in front-end code, where anyone can read them. Enter your URL and we scan the page and its public JavaScript bundles for known key formats. Matches are masked.

Passive, read-only check. No signup, no email needed.

What this checks

  • Stripe live and test secret keys (sk_live_, rk_live_, sk_test_)
  • OpenAI and Anthropic API keys
  • AWS access key IDs, GitHub and Slack tokens, SendGrid keys
  • Supabase service_role JWTs and sb_secret_ keys
  • Private keys (PEM) and Google service account JSON
  • Public keys that are fine to expose (Supabase anon, Firebase config) are labelled as such

How it works (and what it never does)

  • We fetch your page and up to 12 same-origin JavaScript files, exactly as a visitor's browser downloads them.
  • We match known key formats and skip obvious placeholders.
  • Keys are masked in results and never stored or sent anywhere.

Fix guides

FAQ

What should I do if a secret key shows up?

Treat it as compromised: rotate (revoke and re-create) the key at the provider straight away, then move the call that needs it into a server function or edge function. Deleting it from the code isn't enough, because old bundles and caches may still contain it.

Is my Supabase anon or publishable key a leak?

No. It's designed to be public. It's only safe if Row Level Security and table grants are set correctly, which you can check with our Supabase RLS checker.

Why are the keys masked?

So this page can't be used to harvest working keys from other people's sites. You see enough of the key (prefix and last four characters) to find it in your code.

Does it find every possible secret?

No. It matches well-known key formats in the page and same-origin bundles. Custom tokens, keys in third-party scripts or secrets only loaded after login won't be found.

More free tools