Back to all patterns
Stripe Secret API Key
Security
Detects a Stripe secret API key. Useful for secret-scanning hooks.
/^sk_(test|live)_[A-Za-z0-9]{24,99}$/How it works
Stripe secret keys begin with sk_test_ or sk_live_ followed by a base62 token. Live keys grant production access, scanning for this pattern in committed code protects against accidental key leaks.
Test Cases
Should Match
- sk_test_4eC39HqLyjWDarjtT1zdp7dc
- sk_live_51Hkjk4LgIcRBVwYr3vBlAcZl
Should NOT Match
- pk_test_4eC39HqLyjWDarjtT1zdp7dc
- sk_4eC39HqLyjWDarjtT1zdp7dc
Quick Summary
Matches Stripe secret keys (sk_test_..., sk_live_...). Wire into pre-commit hooks alongside Stripe's own bot.
Key Takeaways
Key Takeaways
- sk_live_ is the high-blast-radius case, block, rotate, and audit immediately if discovered
- sk_test_ keys can still expose customer test data and trigger real downstream webhooks, treat as secrets