# Redact API keys

> Redact AWS, OpenAI, Anthropic, GitHub, Google, Slack, and Hugging Face API keys from logs and pasted text.

Canonical: https://bitbanger.in/entities/api-key
Last updated: 2026-10-27

Category: Credentials and secrets · Entity type: `credential.api_key`

The most common security incident in developer tooling is a key pasted into a ticket, a commit message, or an LLM prompt. Redactly recognises the prefixes used by major providers and redacts the whole key.

## How Redactly detects API keys

- Matched by regex against known key prefixes: AKIA for AWS, sk- and sk-ant- for OpenAI and Anthropic, ghp_ for GitHub, AIza for Google, xox for Slack, and hf_ for Hugging Face.
- Runs independently of the model so a key inside a config dump is caught without context.
- The full key is the span, including the prefix, so no usable fragment survives.

## Why redact API keys?

A leaked key is an immediate, unattended compromise: it does not need a person to click anything.

## Example request

```bash
curl -X POST https://api.bitbanger.in/v1/redact \
  -H "X-API-Key: rdct_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"text": "Config: OPENAI_API_KEY=sk-proj-AbCdEf1234567890AbCdEf1234567890", "style": "replace"}'
```

## FAQ

**Does Redactly redact API keys automatically?**

Yes. Send text to the API and every detected type is redacted, including API keys. To redact only this type, pass the value credential.api_key in the entities filter. No training or configuration is required.

**What happens to API keys after redaction?**

With style set to replace, each match becomes [credential.api_key] — the entity type in square brackets. Setting style to mask replaces every character with a block character, and remove deletes the span entirely.

## Related entity types

- [JSON Web Tokens](https://bitbanger.in/entities/jwt) — Redact JWTs from debug output, HAR files, and support tickets before they leave your environment.
- [Passwords](https://bitbanger.in/entities/password) — Redact plaintext passwords from configuration dumps, tickets, and transcripts before they are shared.
- [Private keys](https://bitbanger.in/entities/private-key) — Redact PEM private keys, header and body, from logs and pasted configuration before they are stored or shared.

Try it on your own text: https://bitbanger.in/entities/api-key