piighost/google-api-key

Google and Google Cloud API key: the fixed AIza prefix then thirty-five base64url characters, thirty-nine in all. Covers the Maps, YouTube, Gemini and Firebase keys, which all share the prefix. Noise is close to zero, and the trailing guard stops a longer token from being truncated into a false key. No collision with any existing pattern.

Label: GOOGLE_API_KEY

Pattern

\bAIza[A-Za-z0-9_-]{35}(?![A-Za-z0-9_-])

Must be caught

• GOOGLE_API_KEY=AIzaSyCDEFGHIJKLMNOPQRSTUVWXYZ012345678 → AIzaSyCDEFGHIJKLMNOPQRSTUVWXYZ012345678
• https://maps.example/api?key=AIzaHIJKLMNOPQRSTUVWXYZ0123456789abcdef → AIzaHIJKLMNOPQRSTUVWXYZ0123456789abcdef

Must be left alone

• AIzaSy0123
• BIzaSyCDEFGHIJKLMNOPQRSTUVWXYZ012345678

Tags: international, secrets, software-dev

Download the detector as TOML