Detection reference · Credentials and secrets · Updated 2026-11-03
Bearer tokens in Authorization headers
Copying a curl command or an HTTP log into an AI chat is the classic way a token travels with a question. A bearer token works for whoever holds it.
At a glance
| Reported as | API key or token |
|---|---|
| Category | Credentials and secrets |
| Severity | critical: direct account or system compromise, as with keys, passwords and tokens |
| Replaced with | [SECRET] |
| Where it runs | The same engine runs in the Chrome extension (free checks, on your device), in the web check and the Windows app (on Redaxa's server; the text is not stored) and in public repository checks. |
| Engine rule | scanner.ts, line 205 |
What it looks like
The word Bearer (any capitalisation), a space, then at least 16 letters, digits, dots, hyphens or underscores.
Example
You paste
curl -H "Authorization: Bearer RedaxaDocsSampleNotRealRedaxaDoc" https://api.example.com/v1/me
Redaxa returns
curl -H "Authorization: [SECRET]" https://api.example.com/v1/me
| Reported as | API key or token |
|---|---|
| Severity | critical: direct account or system compromise, as with keys, passwords and tokens |
| Replaced with | [SECRET] |
| Probable service | Unknown service |
| Credential type | Access token / secret |
| Evidence | The value alone does not identify its owner or issuing service. |
| Recommended action | Identify owner, then rotate if genuine |
All values on this page are synthetic or published specimens; none is a working credential or a real person's data.
In a repository check
The same example, committed to a public repository and run through the free repository check:
docs/api-calls.http: Unattributed token candidate, listed for review (severity medium). Only a generic token prefix or Bearer label matched. It could be an example or ordinary identifier. Kept for context, without a high-confidence API alert; this is not proof of a working secret.- Same value in
tests/fixtures/api-calls.http: Test or example value, counted but not listed. Real-looking keys in test files are still reported.
Values are always shown masked in repository reports. No key is ever tested against its provider.
What it does not flag
Send a Bearer token in the Authorization header: not flagged. The word Bearer in a sentence, without a token after it, is not flagged.
If it already leaked
Work out which service issued the token from the URL it was sent to, then revoke the session or key there.
What Redaxa adds to every finding of this kind: If genuine, revoke or rotate it at the issuing service, update the application, then remove the exposed value from code and review Git history. Deleting it from Git does not revoke access.
Step by step: pasted a key into ChatGPT, or committed one to GitHub.
Check before you paste
The free Chrome extension runs this check inside ChatGPT, Claude, Gemini and Perplexity before a message is sent, on your device and with no daily limit. On the web you get 5 free prompt checks a day with no account.
Add the Chrome extensionTry a free web checkWorried it is already in your code? Check a public GitHub repository free (3 checks a day).
Related
- GitHub tokens
- GitLab personal access tokens
- OpenAI API keys
- Anthropic API keys
- Stripe keys and webhook secrets
- Supabase keys
- Slack tokens and webhook URLs
- Google API keys
- AWS access keys
- npm access tokens
- PyPI API tokens
- Hugging Face access tokens
- SendGrid API keys
- JSON Web Tokens (JWT)
- Passwords in URLs
- Secrets in configuration values
- Passwords written in text
- Private keys (PEM)
- I pasted an API key into ChatGPT: what to do
- Stop API keys leaking into AI prompts
- Check a public GitHub repository for leaked API keys
- Free GitHub secret scanner
- Everything Redaxa detects
Sources
- Redaxa engine: scanner.ts line 205, credential-context.ts line 28 (Unknown service). Every output on this page was produced by that code when the page was built.
- RFC 6750: Bearer Token Usage