Google Gemini API

[random-robbie]

Please review the Community Note before submitting

Note

I have scanned many places with gemini keys and trufflehog has never come back with any info for them so requesting it as its' extremely common

Description

Request for TruffleHog to add detection and verification support for Google Gemini API keys (Google AI Studio API keys). These are API keys used to access Google's Gemini generative AI models through the Gemini API.

Preferred Solution

Pattern Detection:

• Key Format: Google Gemini API keys start with AIzaSy followed by 33 additional characters (total 39 characters)
• Character Set: Alphanumeric (A-Z, a-z, 0-9), hyphens (-), and underscores (_)
• Regex Pattern:

  AIzaSy[A-Za-z0-9_-]{33}

  Or more broadly for all Google API keys:

  AIza[A-Za-z0-9_-]{35}

• Entropy Filter: Recommended to reduce false positives

Example Key for Testing:

AIzaSyBi_WHrAK-au-MzDVLl747gW-XJlhjVS_Q

Common Variable Names to Check:

• GEMINI_API_KEY
• GOOGLE_API_KEY
• gemini_api_key
• apiKey
• key

Verification Method:
TruffleHog should verify detected keys by making a test request to the Gemini API:

curl -X POST \
  'https://generativelanguage.googleapis.com/v1beta/models/gemini-1.5-flash:generateContent' \
  -H 'x-goog-api-key: <DETECTED_KEY>' \
  -H 'Content-Type: application/json' \
  -d '{"contents":[{"parts":[{"text":"test"}]}]}'

Success Indicators:

• HTTP 200 status code
• Response contains $.candidates field in JSON

Failure Indicators (Invalid Key):

• HTTP 400 status code
• Error response with "API key not valid" message

Output Should Include:

• Whether the key is valid (verified)
• Key prefix for identification (e.g., AIzaSy***)
• Location where key was found
• Potential security impact warning

Additional Context

Security Risk: Exposed Gemini API keys allow unauthorized access to:

• Quota consumption
• Potential charges if billing is enabled
• Access to private data associated with the project
• Model access and API usage

Official Documentation: Google explicitly states that API keys should be treated like passwords and never committed to source control.

References

• Using Gemini API keys | Google AI for Developers
• Gemini API quickstart | Google AI for Developers
• Google Gemini API Key Tester
• Google API Key Regular Expression - Regex Pattern
• Microsoft Purview - Google API key entity definition

Related: TruffleHog currently detects generic Google API keys (pattern starting with AIza), but specific Gemini API key detection with proper verification would help identify this increasingly common credential type as Google Gemini adoption grows.