Validate API key format
A key passes when it starts with the expected prefix, is exactly 18 characters long including that prefix and uses only letters and digits after it. Catch truncated, space-padded or wrong-environment keys early. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Runs in your browser. Free, unlimited — your data never leaves this page.
Use it to catch truncation, accidental spaces, copy-and-paste damage, or a key from the wrong environment before a credential reaches configuration or deployment tooling.
Describe the format you expect
Provide the candidate in the <code>key</code> field and put the complete expectation in <code>pattern</code>. The pattern needs three values: <code>prefix</code>, <code>length</code>, and <code>charset</code>. Length means the total JavaScript string length, including the prefix, rather than only the secret body.
Charset applies to the portion after a correctly matched prefix. You may instead provide an explicit string containing every allowed character, which is useful for a provider-specific alphabet. An empty prefix is valid when a provider does not use one, but the prefix value must still be present as a string.
The pattern itself is mandatory. Keeping all three constraints together makes the expected format explicit and prevents a caller from accidentally treating a generic length check as complete validation. The maximum accepted length is 10,000 characters, a generous bound that also keeps processing predictable.
Read each validation result separately
The top-level <code>valid</code> value is true only when all three tests succeed. The candidate key itself is deliberately not returned. If the prefix does not match, the charset test examines the full candidate because the tool cannot safely infer where its secret body would begin.
This can produce more than one failed check, which is useful diagnostic information rather than an attempt to guess the intended key. Results are deterministic: identical inputs always produce identical outputs, with no clock, randomness, provider state, or network availability involved. A false result describes a format mismatch, not a revoked or inactive credential.
Use format validation at safe boundaries
Format checks are most valuable immediately before a key enters a configuration store, deployment variable, command-line workflow, or integration setup form. They catch structural mistakes early, without sending the credential to the issuing service merely to learn that its shape is wrong. A matching result should be treated as a preliminary check only.
It cannot prove that the credential exists, belongs to the expected account, has suitable permissions, has not expired, or has not been revoked. Those facts require authentication against the provider and belong in a separate, explicitly authorized workflow. Avoid writing keys or complete validator inputs to application logs, analytics events, support tickets, or error trackers.
In a user interface, show the individual booleans and lengths while masking the original candidate. In either channel, define the pattern from current provider documentation and review it when the provider changes its credential format.
What you can do with it
Guard a deployment variable
Reject a truncated, space-padded, or wrong-environment key before a deployment begins.
Validate an integration form
Give a user precise feedback about prefix, length, and invalid characters without attempting authentication.
Check configuration migrations
Confirm that migrated secret values retain the expected structural format without exposing them in output.
FAQ
What does length include?
It is the exact total JavaScript string length, including the prefix and the secret body.
Which named charsets are available?
You may also supply an explicit string of allowed characters.
Does a valid result mean my access key works?
No. It only confirms the shape of the key. It cannot prove that the key exists, belongs to the right account, has the right permissions or has not expired or been revoked; only the issuing service can tell you that.
Is my key sent anywhere during the check?
No. The check makes no network request and never contacts the provider that issued the key. The key itself is not repeated in the result, so you can show the outcome without exposing the secret.
Why do I see several failed checks when only the prefix is wrong?
When the prefix does not match, the tool cannot know where the secret part begins, so it checks the characters of the whole key. That can add a character failure to the prefix failure, which helps you spot the real problem.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/security/api-key-format-validate \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"key":"sk_live_Ab3dE5fG7h","pattern":{"prefix":"sk_live_","length":18,"charset":"alphanumeric"}}'const res = await fetch("https://api.kit.forhosting.com/security/api-key-format-validate", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"key": "sk_live_Ab3dE5fG7h",
"pattern": {
"prefix": "sk_live_",
"length": 18,
"charset": "alphanumeric"
}
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/security/api-key-format-validate",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"key": "sk_live_Ab3dE5fG7h",
"pattern": {
"prefix": "sk_live_",
"length": 18,
"charset": "alphanumeric"
}
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/security/api-key-format-validate", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"key":"sk_live_Ab3dE5fG7h","pattern":{"prefix":"sk_live_","length":18,"charset":"alphanumeric"}}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"key":"sk_live_Ab3dE5fG7h","pattern":{"prefix":"sk_live_","length":18,"charset":"alphanumeric"}}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/security/api-key-format-validate", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"key": "sk_live_Ab3dE5fG7h",
"pattern": {
"prefix": "sk_live_",
"length": 18,
"charset": "alphanumeric"
}
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "security.api_key_format_validate",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
API keys often have a recognizable shape even when their validity can only be confirmed by the service that issued them. This validator checks that shape: the required prefix, the exact total length, and the characters allowed after the prefix. It performs no network request, does not authenticate with a provider, and does not claim that a matching key is active.
Describe the format you expect
Common named charsets include <code>alphanumeric</code>, <code>lowercase_alphanumeric</code>, <code>uppercase_alphanumeric</code>, <code>hex</code>, <code>lowercase_hex</code>, and <code>base64url</code>.
Read each validation result separately
The response also reports <code>has_prefix</code>, <code>length_matches</code>, and <code>charset_matches</code> independently, so a configuration interface can explain exactly what needs correction. <code>actual_length</code> and <code>expected_length</code> make truncation or an extra pasted character easy to spot. When the alphabet check fails, <code>invalid_characters</code> lists each distinct disallowed character once, in the order first encountered.
Use format validation at safe boundaries
The deterministic implementation can run in the browser for an immediate local check; automated systems can call the API for $0.002 per request.
Technical questions
Does a valid result mean the API key is active?
No. It only means the string matches the supplied format. It does not contact, authenticate with, or query the issuing provider.
Is the API key returned in the response?
No. The response contains validation facts and distinct invalid characters, but never echoes the candidate key.
What happens if no pattern is provided?
The request fails with an invalid_input error because prefix, length, and charset expectations are required.
How much does an API request cost?
Each API request costs $0.002. The same deterministic validation can run locally in the browser.