Detection reference · Credentials and secrets · Updated 2026-11-03

Google API keys (AIza…)

Every Google API key starts with AIza, whether it unlocks Maps in a web page, Firebase, or a paid AI API. The prefix cannot tell those apart, so Redaxa reports the key and asks the question that matters: what is this key allowed to do?

At a glance

Reported as	API key or token
Category	Credentials and secrets
Severity	critical: direct account or system compromise, as with keys, passwords and tokens
Replaced with	`[SECRET]`
Where it runs	The same engine runs in the Chrome extension (free checks, on your device), in the web check and the Windows app (on Redaxa's server; the text is not stored) and in public repository checks.
Engine rule	scanner.ts, line 205

What it looks like

AIza followed by at least 20 letters, digits, hyphens or underscores.

Example

You paste

const MAPS_KEY = "AIzaRedaxaDocsSampleNotRealRedaxaDocsSa";

Redaxa returns

const MAPS_KEY = "[SECRET]";

Reported as	API key or token
Severity	critical: direct account or system compromise, as with keys, passwords and tokens
Replaced with	`[SECRET]`
Probable service	Google APIs
Credential type	API key
Evidence	Google-style prefix does not distinguish Maps, Firebase, Gemini or another API.
Recommended action	Check restrictions and exposure

All values on this page are synthetic or published specimens; none is a working credential or a real person's data.

In a repository check

The same example, committed to a public repository and run through the free repository check:

web/src/maps.js: API key or token, listed for review (severity medium). Google API key pattern. Some browser keys are intentionally public; verify application/API restrictions and billing scope before deciding whether rotation is needed.
Same value in tests/fixtures/maps.js: Test or example value, counted but not listed. Real-looking keys in test files are still reported.

Values are always shown masked in repository reports. No key is ever tested against its provider.

What it does not flag

Keys start with AIza and are 39 characters long: not flagged. The prefix inside a sentence, without a key body, is not flagged.

If it already leaked

Open the key in Google Cloud (APIs & Services, Credentials). If its application and API restrictions allow misuse, create a restricted replacement, move your apps to it and delete the old key.

What Redaxa adds to every finding of this kind: Inspect API and application restrictions in Google Cloud. If exposure allows unauthorized use, replace the key and restrict its replacement. A prefix alone cannot prove that a browser key is unsafe.

Official guidance: docs.cloud.google.com.

Step by step: pasted a key into ChatGPT, or committed one to GitHub.

Check before you paste

The free Chrome extension runs this check inside ChatGPT, Claude, Gemini and Perplexity before a message is sent, on your device and with no daily limit. On the web you get 5 free prompt checks a day with no account.

Add the Chrome extension Try a free web check

Worried it is already in your code? Check a public GitHub repository free (3 checks a day).

Sources

Redaxa engine: scanner.ts line 205, credential-context.ts line 43 (Google APIs). Every output on this page was produced by that code when the page was built.
Google Cloud: Best practices for managing API keys