API Key Pattern Regex Pattern

Live Regex Tester

Pattern Breakdown

Code Examples

const regex = /(?:api[_-]?key|apikey|token)[\s]*[=:][\s]*["']?([a-zA-Z0-9_-]{20,})["']?/gi;
const test = "api_key="sk_live_abc123def456ghi789"";
console.log(regex.test(test)); // true

// Extract matches
const matches = test.match(regex);
console.log(matches);

import re

pattern = r'(?:api[_-]?key|apikey|token)[\s]*[=:][\s]*["']?([a-zA-Z0-9_-]{20,})["']?'
test = "api_key="sk_live_abc123def456ghi789""
match = re.findall(pattern, test, re.IGNORECASE)
print(match)  # Found!

package main

import (
    "fmt"
    "regexp"
)

func main() {
    re := regexp.MustCompile(`(?:api[_-]?key|apikey|token)[\s]*[=:][\s]*["']?([a-zA-Z0-9_-]{20,})["']?`)
    fmt.Println(re.MatchString("api_key="sk_live_abc123def456ghi789"")) // true
}

Common Use Cases

Match Examples

About the API Key Pattern Regex

Matches assignments such as api_key=, apiKey:, or token = followed by a value of 20 or more letters, digits, underscores, or hyphens, with optional quotes, case-insensitively; the captured group is the candidate secret. It is a generic catch-all for secret scanning and code review, not a vendor-specific detector: it does not know prefixes like sk_live_ or AKIA and will also flag long non-secret identifiers assigned to a key-like name.

Regular expressions (regex) are powerful pattern matching tools used across virtually all programming languages. The api key pattern pattern is classified as advanced difficulty in the security & auth category. It works in all major programming languages.

When using this regex, always consider edge cases and test thoroughly with real-world data. Use the interactive tester above to validate the pattern against your specific inputs before deploying to production.

More Security & Auth Patterns

Related Regex Guides