Appendix B · Key-format quick reference
The Secret Leak Field Manual · 4 min read
Every example below is synthetic — each contains an embedded FAKE marker and matches none of the formats' real entropy requirements. Use these strings in docs, tests, and drills. Severity ratings follow Chapter 3's rubric.
The table
| Provider / system | Credential | Synthetic example | Anatomy | Disposition |
|---|---|---|---|---|
| Supabase | service_role JWT (legacy) | eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJvbGUiOiJzZXJ2aWNlX3JvbGUiLCJpYXQiOjE3NTQwMDAwMDB9.FAKE_SIGNATURE_EXAMPLE_ONLY | Three-part JWT; role claim in payload | Secret — critical; legacy, deprecated end of 2026 |
| Supabase | Local-dev service_role JWT | Same shape; issuer supabase-demo | Minted identically by local dev on every machine | Not a leak — grants nothing hosted |
| Supabase | anon / authenticated JWT (legacy) | Same shape; role anon | Three-part JWT | Public by design |
| Supabase | Publishable key | sb_publishable_… shape | sb_publishable_ prefix | Public by design |
| Supabase | Secret key | sb_secret_… shape | sb_secret_ prefix | Secret — critical |
| Supabase | Management token | sbp_… shape | sbp_ prefix, account-level | Secret — critical |
| Stripe | Secret key | sk_live_FAKE000000000000000000000 | sk_live_ + 24-char body | Secret — critical |
| Stripe | Test secret key | sk_test_… shape | sk_test_ prefix | Medium — sandbox data only |
| Stripe | Restricted key | rk_live_FAKE000000000000000000000 | rk_live_ + body | Secret — high (bounded by permissions) |
| Stripe | Publishable key | pk_live_FAKE000000000000000000000 | pk_live_ + body | Public by design |
| Stripe | Webhook signing secret | whsec_FAKE000000000000000000000000 | whsec_ prefix, per endpoint | Secret — high (forgeries your endpoint accepts) |
| Clerk | Secret key | Stripe-shaped (sk_live_…) | Identical shape to Stripe's | Confirm attribution before rotating |
| OpenAI | Project key | sk-proj-FAKE000000000000000000000000 | sk-proj- prefix | Secret — critical |
| OpenAI | Admin key | sk-admin-… shape | sk-admin- prefix | Secret — critical, org-wide scope |
| OpenAI-compatible gateways | Legacy-shape key (DeepSeek, Groq, Together, Fireworks) | sk-FAKE0000000000000000000000000000 | Bare sk- prefix | Secret — critical at named provider |
| Anthropic | API key | sk-ant-api03-FAKE0000000000000000000000000000000000000000000000 | sk-ant- family prefixes | Secret — critical |
| AWS | Access key ID (long-lived) | AKIAFAKEEXAMPLE000000 | AKIA + 16 chars | Secret when paired — critical |
| AWS | Access key ID (temporary) | ASIA… shape | ASIA prefix + session token | Secret while valid — high/critical |
| AWS | Documented sample key | AKIAIOSFODNN7EXAMPLE | Appears in AWS documentation everywhere | Not a leak — reject by name |
| Google / Firebase | Web API key | AIza… shape | AIza prefix | Public by design — severity depends on API restrictions |
| GitHub | Classic PAT | ghp_FAKE0000000000000000000000000000000 | ghp_/gho_/ghu_/ghs_/ghr_ prefixes | Secret — critical (scope-bounded) |
| GitHub | Fine-grained PAT | github_pat_FAKE000000000000000000_0000000000000000000000000000000 | Long prefix + two segments | Secret — high (owner/repo/permission bounded) |
| Resend | API key | re_FAKE_000000000000000000000 | re_ prefix | Secret — high |
| SendGrid | API key | SG.FAKE0000000000000000000.0000000000000000000000000000000000000 | SG. + two dot-separated segments | Secret — high (scoped or full access) |
| Slack | Bot token | xoxb-0000-FAKE000000000000000 | xox[baprs]- family | Secret — high per scope |
| Mapbox | Secret token | sk.eyJFAKE0000000000000000.FAKE0000000000000000 | sk. prefix, token-management scope | Secret — high; only pk. belongs in browsers |
| PostgreSQL | Connection string | postgresql://app:FAKEPASSWORD@db.example.internal:5432/prod | Scheme with embedded password | Secret — critical |
| MongoDB | Connection string | mongodb+srv://app:FAKEPASSWORD@cluster0.example.mongodb.net/prod | Scheme with embedded password | Secret — critical |
| Generic | Credential-named high-entropy value | apiKey: "FAKE_000000000000000000000000000" | Key-named variable holding random-looking value | Investigate — medium until attributed |
| PEM | Private key block | -----BEGIN PRIVATE KEY-----\nFAKE000000...\n-----END PRIVATE KEY----- | Standard armor lines | Secret — critical |
Recognition rules that prevent expensive mistakes
- Prefixes prove format, not validity. A perfectly shaped string of zeros is still a zero. Randomness lives in the body.
- Documented samples are not leaks. Some sample keys are printed in provider documentation so widely that reporting them is noise; the table flags them where they exist.
- Shared shapes need attribution. Clerk/Stripe and the OpenAI-compatible gateway family mean one string maps to several possible providers. Name what you know; rotate regardless.
- Public-by-design keys are findings only when unprotected. An
AIzakey without API restrictions, a Mapbox setup missing URL restrictions — fix the restriction, not the secrecy.
Sources for current behavior
Stripe (docs.stripe.com/keys) · Supabase (API keys guide) · GitHub (managing PATs, secret scanning) · AWS (IAM access keys) · OpenAI (help center) · SendGrid (API keys) · Slack (token types) · Mapbox (tokens) · MongoDB Atlas (database users) · Firebase (API keys).