{"uid":"cap_iMl2EVof6ppAcd_2yzxFC","slug":"apiacre-secret-scanner-eea31189","name":"APIAcre Secret Scanner","description":"Detect likely leaked API keys, tokens, private-key headers, JWTs, and credential assignments in caller-supplied source or configuration text. Return type, line, fingerprint, and a fully redacted preview with no network access or code execution.","url":"https://apiacre.com/v1/developer/secret-scan","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"content":{"type":"string","title":"Content","maxLength":2000000}}},"responseSchema":{"type":"json","example":{"data":{"clean":false,"findings":[{"line":1,"type":"generic_assignment","preview":"[REDACTED]","fingerprint":"360b25f697c5fca0"}],"findingCount":1},"meta":{"cached":false,"sources":[],"warnings":[],"duration_ms":42,"next_actions":[]},"service":"developer.secret-scan","version":"1","request_id":"018f1f54-7f38-7ba2-8dc3-5f90272d9f1a"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_2OpHjuJrGwHYhJ2sncLXi","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scans source code or configuration text for leaked API keys, tokens, and credentials without revealing the actual secret values.","exampleAgentPrompt":"Can you scan this source code for any leaked API keys, tokens, or credentials? I want to know what types of secrets are exposed and where, but I don't need to see the actual secret values — just tell me what was found.","exampleUseCases":[{"title":"Pre-commit credential leak check","prompt":"Before I push this code to GitHub, can you scan it for any hardcoded API keys or tokens? Here's the content of my config.js — flag anything that looks like a leaked credential without showing me the actual secret values."},{"title":"CI pipeline secret audit","prompt":"I want to audit this environment configuration file for any exposed secrets before deploying to production — can you scan this .env file and tell me what types of credentials are detected and where they appear?"},{"title":"Third-party code security review","prompt":"I received this code snippet from a contractor and need to check it for any accidentally leaked tokens or API keys before I run it — can you scan it and list any detected secrets by type and location?"}],"resultDescription":"Returns a structured list of detected secrets found in the submitted text, including the type of credential (e.g. AWS key, OpenAI token, GitHub token), the location or line context where it was found, and severity or confidence indicators — without returning the actual secret values themselves.","failureModes":["Input text is empty or too short to analyze meaningfully","Obfuscated or encoded secrets may not be detected","Custom or proprietary token formats may not match known patterns","Very large inputs may exceed size limits","False positives may be returned for test/example credentials that resemble real secrets"],"whenToPreferThis":"Choose this endpoint when you need to programmatically audit source code, configuration files, or any text blob for accidentally leaked credentials before committing, deploying, or sharing. It is specifically designed to report secret types and locations without echoing back the secret values, making it safe to use in automated pipelines. Prefer this over general-purpose text analysis tools when the goal is security-focused credential detection with developer context.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T12:40:19.993Z","isFirstParty":false}