Skip to content
Switch branches/tags


Failed to load latest commit information.
Latest commit message
Commit time

KeyHacks shows ways in which particular API keys found on a Bug Bounty Program can be used, to check if they are valid.

@Gwen001 has scripted the entire process available here and it can be found here

Table of Contents

Detailed Information

Slack Webhook

If the below command returns missing_text_or_fallback_or_attachments, it means that the URL is valid, any other responses would mean that the URL is invalid.

curl -s -X POST -H "Content-type: application/json" -d '{"text":""}' ""

Slack API token

curl -sX POST ""

SauceLabs Username and access Key


Facebook AppSecret

You can generate access tokens by visiting the URL below.

Facebook Access Token


Requires a custom token, and an API key.

  1. Obtain ID token and refresh token from custom token and API key: curl -s -XPOST -H 'content-type: application/json' -d '{"token":":custom_token","returnSecureToken":True}' ''
  2. Exchange ID token for auth token: curl -s -XPOST -H 'content-type: application/json' -d '{"idToken":":id_token"}''

Github Token

curl -s -u "user:apikey"
curl -s -H "Authorization: token TOKEN_HERE" ""
# Check scope of your api token
curl "" -i -u "user:apikey" | grep "X-OAuth-Scopes:"

Github client id and client secret

curl ''

Firebase Cloud Messaging


curl -s -X POST --header "Authorization: key=AI..." --header "Content-Type:application/json" '' -d '{"registration_ids":["1"]}'

GitHub private SSH key

SSH private keys can be tested against to see if they are registered against an existing user account. If the key exists the username corresponding to the key will be provided. (source)

$ ssh -i <path to SSH private key> -T
Hi <username>! You've successfully authenticated, but GitHub does not provide shell access.

Twilio Account_sid and Auth token


Twitter API Secret

curl -u 'API key:API secret key' --data 'grant_type=client_credentials' ''

Twitter Bearer token

curl --request GET --url --header 'authorization: Bearer TOKEN'

HubSpot API key

Get all owners:{keyhere}

Get all contact details:{keyhere}

Deviant Art Secret

curl -d grant_type=client_credentials -d client_id=ID_HERE -d client_secret=mysecret

Deviant Art Access Token

curl -d access_token=Alph4num3r1ct0k3nv4lu3

Pendo Integration Key

curl -X GET -H 'content-type: application/json' -H 'x-pendo-integration-key:KEY_HERE'
curl -X GET -H 'content-type: application/json' -H 'x-pendo-integration-key:KEY_HERE'

SendGrid API Token

curl -X "GET" "" -H "Authorization: Bearer SENDGRID_TOKEN-HERE" -H "Content-Type: application/json"



App id/client secret: sq0[a-z]{3}-[0-9A-Za-z\-_]{22,43} Auth token: EAAA[a-zA-Z0-9]{60}

Test App id & client secret:

curl "" -d '{"access_token":"[RANDOM_STRING]","client_id":"[APP_ID]"}'  -H "Content-Type: application/json" -H "Authorization: Client [CLIENT_SECRET]"

Response indicating valid credentials:


Response indicating invalid credentials:

  "message": "Not Authorized",
  "type": "service.not_authorized"

Test Auth token:

curl -H "Authorization: Bearer [AUHT_TOKEN]"

Response indicating valid credentials:

{"locations":[{"id":"CBASELqoYPXr7RtT-9BRMlxGpfcgAQ","name":"Coffee \u0026 Toffee SF","address":{"address_line_1":"1455 Market Street","locality":"San Francisco","administrative_district_level_1":"CA","postal_code":"94103","country":"US"},"timezone":"America/Los_Angeles"........

Response indicating invalid credentials:

{"errors":[{"category":"AUTHENTICATION_ERROR","code":"UNAUTHORIZED","detail":"This request could not be authorized."}]}

Dropbox API

curl -X POST --header "Authorization: Bearer TOKEN_HERE"

AWS Access Key ID and Secret

Install awscli, set the access key and secret to environment variables, and execute the following command:

AWS_ACCESS_KEY_ID=xxxx AWS_SECRET_ACCESS_KEY=yyyy aws sts get-caller-identity

AWS credentials' permissions can be determined using Enumerate-IAM. This gives broader view of the discovered AWS credentials privileges instead of just checking S3 buckets.

git clone
cd  enumerate-iam
./ --access-key AKIA... --secret-key StF0q...

Lokalise API Key

  --url \
  --header 'x-api-token: [API-KEY-HERE]'

MailGun Private Key

curl --user 'api:YOUR_API_KEY' ""

FreshDesk API Key

curl -v -u -X GET ''
This requires the API key in '', pass in 'test' and '' to be the instance url of the target. In case you get a 403, try the endpoint api/v2/tickets, which is accessible for all keys.

JumpCloud API Key


List systems:
curl -H "x-api-key: APIKEYHERE" ""
curl -H "x-api-key: APIKEYHERE" ""
curl -H "x-api-key: APIKEYHERE" ""


List systems:
curl -X GET{System_ID}/memberof \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -H 'x-api-key: {API_KEY}'

Microsoft Azure Tenant


CLIENT_ID: [0-9a-z\-]{36}
CLIENT_SECRET: [0-9A-Za-z\+\=]{40,50}
TENANT_ID: [0-9a-z\-]{36}


curl -X POST -H "Content-Type: application/x-www-form-urlencoded" -d 'client_id=<CLIENT_ID>&<CLIENT_SECRET>&grant_type=client_credentials' '<TENANT_ID>/oauth2/v2.0/token'

Microsoft Shared Access Signatures (SAS)

The following powershell can be used to test a Shared Access Signature Token:

static void UseAccountSAS(string sasToken)
    // Create new storage credentials using the SAS token.
    StorageCredentials accountSAS = new StorageCredentials(sasToken);
    // Use these credentials and the account name to create a Blob service client.
    CloudStorageAccount accountWithSAS = new CloudStorageAccount(accountSAS, "account-name", endpointSuffix: null, useHttps: true);
    CloudBlobClient blobClientWithSAS = accountWithSAS.CreateCloudBlobClient();

    // Now set the service properties for the Blob client created with the SAS.
    blobClientWithSAS.SetServiceProperties(new ServiceProperties()
        HourMetrics = new MetricsProperties()
            MetricsLevel = MetricsLevel.ServiceAndApi,
            RetentionDays = 7,
            Version = "1.0"
        MinuteMetrics = new MetricsProperties()
            MetricsLevel = MetricsLevel.ServiceAndApi,
            RetentionDays = 7,
            Version = "1.0"
        Logging = new LoggingProperties()
            LoggingOperations = LoggingOperations.All,
            RetentionDays = 14,
            Version = "1.0"

    // The permissions granted by the account SAS also permit you to retrieve service properties.
    ServiceProperties serviceProperties = blobClientWithSAS.GetServiceProperties();

New Relic Personal API Key (NerdGraph)

curl -X POST \
-H 'Content-Type: application/json' \
-d '{ "query":  "{ requestContext { userId apiKey } }" } '

New Relic REST API

curl -X GET '' \
     -H "X-Api-Key:${APIKEY}" -i

If valid, test further to see if it's an admin key

Heroku API key

curl -X POST -H "Accept: application/vnd.heroku+json; version=3" -H "Authorization: Bearer API_KEY_HERE"

Mapbox API key

Mapbox secret keys start with sk, rest start with pk (public token), sk (secret token), or tk (temporary token).

curl ""

Salesforce API key

curl -H 'Authorization: Bearer access_token_here'

Algolia API key

Be cautious when running this command, since the payload might execute within an administrative environment, depending on what index you are editing the highlightPreTag of. It's recommended to use a more silent payload (such as XSS Hunter) to prove the possible cross-site scripting attack.

curl --request PUT \
  --url https://<application-id><example-index>/settings \
  --header 'content-type: application/json' \
  --header 'x-algolia-api-key: <example-key>' \
  --header 'x-algolia-application-id: <example-application-id>' \
  --data '{"highlightPreTag": "<script>alert(1);</script>"}'

Zapier Webhook Token

curl -H "Accept: application/json" -H "Content-Type: application/json" -X POST -d '{"name":"streaak"}' "webhook_url_here"

Pagerduty API token

curl -H "Accept: application/vnd.pagerduty+json;version=2"  -H "Authorization: Token token=TOKEN_HERE" -X GET  ""

BrowserStack Access Key


Google Maps API key

Key restrictions are set per service. When testing the key, if the key is restricted/inactive on one service try it with another.

Name Endpoint Pricing
Static Maps $2
Streetview,-73.988354&fov=90&heading=235&pitch=10&key=KEY_HERE $7
Embed Varies
Directions $5
Geocoding,30&key=KEY_HERE $5
Distance Matrix,-73.89188969999998&destinations=40.6905615%2C-73.9976592%7C40.6905615%2C-73.9976592%7C40.6905615%2C-73.9976592%7C40.6905615%2C-73.9976592%7C40.6905615%2C-73.9976592%7C40.6905615%2C-73.9976592%7C40.659569%2C-73.933783%7C40.729029%2C-73.851524%7C40.6860072%2C-73.6334271%7C40.598566%2C-73.7527626%7C40.659569%2C-73.933783%7C40.729029%2C-73.851524%7C40.6860072%2C-73.6334271%7C40.598566%2C-73.7527626&key=KEY_HERE $5
Find Place from Text,formatted_address,name,rating,opening_hours,geometry&key=KEY_HERE Varies
Autocomplete Varies
Elevation,-104.9847034&key=KEY_HERE $5
Timezone,-119.6822510&timestamp=1331161200&key=KEY_HERE $5
Roads,24.942795|60.170879,24.942796|60.170877,24.942796&key=KEY_HERE $10
Geolocate $5

*Pricing is in USD per 1000 requests (for the first 100k requests)

More Information available here-

Google Recaptcha key

Send a POST to the following URL:

secret and response are two required POST parameters, where secret is the key and response is the response to test for.

Regular expression: ^6[0-9a-zA-Z_-]{39}$. The API key always starts with a 6 and is 40 chars long. Read more here:

Google Cloud Service Account credentials

Service Account credentials may be found in a JSON file like this:

$ cat service_account.json
  "type": "service_account",
  "project_id": "...",
  "private_key_id": "...",
  "private_key": "-----BEGIN PRIVATE KEY-----...-----END PRIVATE KEY-----\n",
  "client_email": "...",
  "client_id": "...",
  "auth_uri": "",
  "token_uri": "",
  "auth_provider_x509_cert_url": "",
  "client_x509_cert_url": ""

If this is your case you may check these credentials using gcloud tool (how to install gcloud):

$ gcloud auth activate-service-account --key-file=service_account.json
Activated service account credentials for: [...]
$ gcloud auth print-access-token

In case of success you'll see access token printed in terminal. Please note that after verifying that credentials are actually valid you may want to enumerate permissions of these credentials which is another story.

Branch.IO Key and Secret

Visit the following URL to check for validity:

Bing Maps API Key

Visit this link to check for the key's validity. A valid key's response should start with authenticationResultCode: "ValidCredentials" Access token

Visit the following URL to check for validity:

Buildkite Access token

curl -H "Authorization: Bearer ACCESS_TOKEN" \


curl -X GET ''

Asana Access token

curl -H "Authorization: Bearer ACCESS_TOKEN"

Zendesk Access token

curl https://{subdomain} \
  -H "Authorization: Bearer ACCESS_TOKEN"

MailChimp API Key

curl --request GET --url 'https://<dc>' --user 'anystring:<API_KEY>' --include

WPEngine API Key

This issue can be further exploited by checking out @hateshape's gist

curl ""

DataDog API key

curl "<api_key>&application_key=<application_key>"

Travis CI API token

curl -H "Travis-API-Version: 3" -H "Authorization: token <TOKEN>"

WakaTime API Key

curl ""

Sonarcloud Token

curl -u <token>: ""

Spotify Access Token

curl -H "Authorization: Bearer <ACCESS_TOKEN>"

Instagram Basic Display API Access Token

E.g.: IGQVJ...

curl -X GET '{user-id}?fields=id,username&access_token={access-token}'

Instagram Graph API Access Token

E.g.: EAAJjmJ...

curl -i -X GET '{access-token}'

Gitlab personal access token

curl "<your_access_token>"

Paypal client id and secret key

curl -v \
   -H "Accept: application/json" \
   -H "Accept-Language: en_US" \
   -u "client_id:secret" \
   -d "grant_type=client_credentials"

The access token can be further used to extract data from the PayPal API. More information:

This can be verified using:

curl -v -X GET "" -H "Content-Type: application/json" -H "Authorization: Bearer [ACCESS_TOKEN]"

Stripe Live Token

curl -u token_here:

Keep the colon at the end of the token to prevent cURL from requesting a password.

The token is always in the following format: sk_live_24charshere, where the 24charshere part contains 24 characters from a-z A-Z 0-9. There is also a test key, which starts with sk_test, but this key is worthless since it is only used for testing purposes and most likely doesn't contain any sensitive information. The live key, on the other hand, can be used to extract/retrieve a lot of info — ranging from charges to the complete product list.

Keep in mind that you will never be able to get the full credit card information since Stripe only gives you the last 4 digits.

More info/complete documentation:

Razorpay API key and Secret key

This can be verified using:


CircleCI Access Token


Loqate API key

curl '<KEY_HERE>&Countries=US,CA&Language=en&Limit=5&Text=BHAR'

Ipstack API Key

curl '{ip_address}?access_key={keyhere}'

NPM token

You can verify NPM token using npm (replacing 00000000-0000-0000-0000-000000000000 with NPM token):

export NPM_TOKEN="00000000-0000-0000-0000-000000000000"
echo "//${NPM_TOKEN}" > .npmrc
npm whoami

Another way to verify token is to query API directly:

curl -H 'authorization: Bearer 00000000-0000-0000-0000-000000000000' ''

You'll get username in response in case of success, 401 Unauthorized in case if token doesn't exists and 403 Forbidden in case if your IP address is not whitelisted.

NPM token can be CIDR-whitelisted. Thus if you are using token from non-whitelisted CIDR you'll get 403 Forbidden in response. So try to verify NPM token from different IP ranges!.

P.S. Some companies uses registries other than If it's the case replace all occurrences with domain name of company's NPM registry. API Key

Get all collections for a specific project:

curl ""

Note: Keep the colon at the end of the token to prevent cURL from requesting a password. Info: The token is always in the following format: sk_live_34charshere, where the 34charshere part contains 34 characters from a-z A-Z 0-9 There is also a test key, which starts with sk_test, but this key is worthless since it is only used for testing purposes and most likely doesn't contain any sensitive info. The live key, on the other hand, can be used to extract/retrieve a lot of info. Going from charges, to the complete product list. Keep in mind that you will never be able to get the full credit card information since stripe only gives you like the last 4 digits. More info / complete docs: =======

Calendly API Key

Get user information:

curl --header "X-TOKEN: <your_token>"

List Webhook Subscriptions:

curl --header "X-TOKEN: <your_token>"

Azure Application Insights APP ID and API Key

Get the total number of requests made in last 24 hours:

curl -H "x-api-key: {API_Key}" "{APP_ID}/metrics/requests/count"

Cypress record key

In order to check recordKey validity you'll need projectId which is public value that usually can be found at cypress.json file. Replace {recordKey} and {projectId} in JSON body with your values.

curl -i -s -k -X $'POST' \
    -H $'x-route-version: 4' -H $'x-os-name: darwin' -H $'x-cypress-version: 5.5.0' -H $'host:' -H $'accept: application/json' -H $'content-type: application/json' -H $'Content-Length: 1433' -H $'Connection: close' \
    --data-binary $'{\"ci\":{\"params\":null,\"provider\":null},\"specs\":[\"cypress/integration/examples/actions.spec.js\",\"cypress/integration/examples/aliasing.spec.js\",\"cypress/integration/examples/assertions.spec.js\",\"cypress/integration/examples/connectors.spec.js\",\"cypress/integration/examples/cookies.spec.js\",\"cypress/integration/examples/cypress_api.spec.js\",\"cypress/integration/examples/files.spec.js\",\"cypress/integration/examples/local_storage.spec.js\",\"cypress/integration/examples/location.spec.js\",\"cypress/integration/examples/misc.spec.js\",\"cypress/integration/examples/navigation.spec.js\",\"cypress/integration/examples/network_requests.spec.js\",\"cypress/integration/examples/querying.spec.js\",\"cypress/integration/examples/spies_stubs_clocks.spec.js\",\"cypress/integration/examples/traversal.spec.js\",\"cypress/integration/examples/utilities.spec.js\",\"cypress/integration/examples/viewport.spec.js\",\"cypress/integration/examples/waiting.spec.js\",\"cypress/integration/examples/window.spec.js\"],\"commit\":{\"sha\":null,\"branch\":null,\"authorName\":null,\"authorEmail\":null,\"message\":null,\"remoteOrigin\":null,\"defaultBranch\":null},\"group\":null,\"platform\":{\"osCpus\":[],\"osName\":\"darwin\",\"osMemory\":{\"free\":1153744896,\"total\":17179869184},\"osVersion\":\"19.6.0\",\"browserName\":\"Electron\",\"browserVersion\":\"85.0.4183.121\"},\"parallel\":null,\"ciBuildId\":null,\"projectId\":\"{projectId}\",\"recordKey\":\"{recordKey}\",\"specPattern\":null,\"tags\":[\"\"]}' \

Yes, this request needs to be that big. It'll return 200 OK with some information about run in case if both projectId and recordKey are valid, 404 Not Found with {"message":"Project not found. Invalid projectId."} if projectId is invalid or 401 Unauthorized with {"message":"Invalid Record Key."} if recordKey is invalid.

Example of projectId is 1yxykz and example of recordKey is a216e7b4-4819-4713-b9c2-c5da60a1c48c.

YouTube API Key

Fetch content details for a YouTube channel (The channelId in this case points to PewDiePie's channel).

curl -iLk '{KEY_HERE}'

ABTasty API Key

curl "api_endpoint_here" -H "x-api-key: your_api_key"

Iterable API Key

Export campaign analytics data in JSON format, one entry per line. Use of either 'range' or 'startDateTime' and 'endDateTime' is required.

curl -H "Api_Key: {API_KEY}"

Amplitude API Keys

The response is a zipped archive of JSON files, with potentially multiple files per hour. Note that events prior to 2014-11-12 will be grouped by day instead of by the hour. If you request data for a time range during which no data has been collected for the project, then you will receive a 404 response from the server.

curl -u API_Key:Secret_Key '' >>

Visual Studio App Center API Token

  1. List all the app projects for the API Token:
curl -sX GET  "" \
-H "Content-Type: application/json" \
-H "X-Api-Token: {your_api_token}"
  1. Fetch the latest app build information for a particular project:

Use the name and obtained in response in Step 1.

curl -sX GET  "{}/{name}/releases/latest" \
-H "Content-Type: application/json" \
-H "X-Api-Token: {your_api_token}"

WeGlot Api Key

curl -X POST \
  '' \
  -H 'Content-Type: application/json' \
  -d '{  
      {"w":"This is a blue car", "t": 1},
      {"w":"This is a black car", "t": 1}

PivotalTracker API Token

  1. List User Information with API Token:
curl -X GET -H "X-TrackerToken: $TOKEN" ""
  1. Obtain API Token with Valid User Credentials:
curl -s -X GET --user 'USER:PASSWORD' " -o pivotaltracker.json"
jq --raw-output .api_token pivotaltracker.json


I welcome contributions from the public.

Using the issue tracker 💡

The issue tracker is the preferred channel for bug reports and features requests.

Issues and labels 🏷

The bug tracker utilizes several labels to help organize and identify issues.

Guidelines for bug reports 🐛

Use the GitHub issue search — check if the issue has already been reported.

Legal Disclaimer

This project is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. Developers assume no liability and are not responsible for any misuse or damage caused by this tool.


Keyhacks is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see if they're valid.



No releases published


No packages published