Detection reference · Credentials and secrets · Updated 2026-11-03
AWS access keys: AKIA, ASIA and the secret access key
An AWS access key comes in two halves: an ID that starts with AKIA (or ASIA for temporary credentials) and a 40-character secret with no prefix at all. Redaxa treats them differently because the ID alone does not grant access.
At a glance
| Reported as | API key or token |
|---|---|
| Category | Credentials and secrets |
| Severity | critical: direct account or system compromise, as with keys, passwords and tokens |
| Replaced with | [SECRET] |
| Where it runs | The same engine runs in the Chrome extension (free checks, on your device), in the web check and the Windows app (on Redaxa's server; the text is not stored) and in public repository checks. |
| Engine rule | scanner.ts, line 205 |
What it looks like
Access key IDs: AKIA or ASIA followed by 16 upper-case letters or digits. Secret access keys: 40 characters of letters, digits, / and +, recognised only right after an assignment such as aws_secret_access_key =, AWS_SECRET_KEY: or secretAccessKey:.
Example 1
You paste
aws_access_key_id = AKIAREDAXADOCSSAMPLE
Redaxa returns
aws_access_key_id = [SECRET]
| Reported as | API key or token |
|---|---|
| Severity | critical: direct account or system compromise, as with keys, passwords and tokens |
| Replaced with | [SECRET] |
| Probable service | AWS |
| Credential type | Access key ID |
| Evidence | An AWS access-key identifier, not the accompanying secret access key. |
| Recommended action | Check whether the secret is also exposed |
Example 2
You paste
aws_secret_access_key = RedaxaDocs0Sample0Not0A0Real0Key0RedaxaD
Redaxa returns
aws_secret_access_key = [SECRET]
| Reported as | AWS secret access key |
|---|---|
| Severity | critical: direct account or system compromise, as with keys, passwords and tokens |
| Replaced with | [SECRET] |
| Probable service | AWS |
| Credential type | Secret access key |
| Evidence | Forty characters next to an AWS secret-access-key assignment; it is not checked against AWS. |
| Recommended action | Revoke or rotate if genuine |
Example 3
You paste
AWS_ACCESS_KEY_ID=ASIAREDAXADOCSSAMPLE
Redaxa returns
AWS_ACCESS_KEY_ID=[SECRET]
| Reported as | API key or token |
|---|---|
| Severity | critical: direct account or system compromise, as with keys, passwords and tokens |
| Replaced with | [SECRET] |
| Probable service | AWS |
| Credential type | Temporary access key ID |
| Evidence | An AWS access-key identifier, not the accompanying secret access key. |
| Recommended action | Check whether the secret is also exposed |
All values on this page are synthetic or published specimens; none is a working credential or a real person's data.
In a repository check
The same example, committed to a public repository and run through the free repository check:
deploy/credentials.ini: API key or token, listed for review (severity medium). AWS access key identifier only. Check whether its paired secret and any session token are exposed before treating this as usable account access.- Same value in
tests/fixtures/credentials.ini: Test or example value, counted but not listed. Real-looking keys in test files are still reported.
Values are always shown masked in repository reports. No key is ever tested against its provider.
What it does not flag
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY: not flagged. The example secret printed in AWS documentation contains EXAMPLE and is skipped.
Known false positives
Text that is harmless but still flagged today. Listed so you can recognise it, not hidden.
aws_access_key_id = AKIAIOSFODNN7EXAMPLE: flagged as API key or token. The matching example ID from AWS documentation has a valid shape and is still flagged. Redaxa reports it as an identifier only, so it is cheap to dismiss.
If it already leaked
In IAM, create a new access key for the user, switch your tools to it, then deactivate and delete the exposed one. For temporary (ASIA) credentials, revoke the role's active sessions. Review CloudTrail for calls made with the old key.
What Redaxa adds to every finding of this kind: Locate the owner and check exposure of the paired secret and, for temporary credentials, session token. Rotate or invalidate compromised credentials in AWS; the identifier alone does not prove usable account access.
What Redaxa adds to every finding of this kind: If genuine, revoke or rotate it at the issuing service, update the application, then remove the exposed value from code and review Git history. Deleting it from Git does not revoke access.
Official guidance: docs.aws.amazon.com.
Step by step: pasted a key into ChatGPT, or committed one to GitHub.
Check before you paste
The free Chrome extension runs this check inside ChatGPT, Claude, Gemini and Perplexity before a message is sent, on your device and with no daily limit. On the web you get 5 free prompt checks a day with no account.
Add the Chrome extensionTry a free web checkWorried it is already in your code? Check a public GitHub repository free (3 checks a day).
Related
- GitHub tokens
- GitLab personal access tokens
- OpenAI API keys
- Anthropic API keys
- Stripe keys and webhook secrets
- Supabase keys
- Slack tokens and webhook URLs
- Google API keys
- npm access tokens
- PyPI API tokens
- Hugging Face access tokens
- SendGrid API keys
- JSON Web Tokens (JWT)
- Bearer tokens
- Passwords in URLs
- Secrets in configuration values
- Passwords written in text
- Private keys (PEM)
- I pasted an API key into ChatGPT: what to do
- Stop API keys leaking into AI prompts
- Check a public GitHub repository for leaked API keys
- Free GitHub secret scanner
- Everything Redaxa detects
Sources
- Redaxa engine: scanner.ts line 205, credential-context.ts line 44 (AWS). Every output on this page was produced by that code when the page was built.
- AWS IAM User Guide: Manage access keys for IAM users