Security & Secrets Tier 1 Ready POST /v1/secret-scanner

Secret Scanner & Log Redaction API — Detect & Mask API Keys, JWTs & Tokens

Detect and mask leaked API keys, JWTs, and private keys in logs, diffs, and prompts. Scan logs, diffs, and LLM prompts for leaked AWS keys, GitHub tokens, Stripe keys, Slack webhooks, JWTs, and private keys with reversible redaction.

Additional endpoints in this module: POST /v1/secret-scanner/restore

Try It Live in Your Browser · No API Key Required

1. Interactive Sandbox & Sample JSON Output

200 OK · Ready

Editable Request JSON (`POST /v1/secret-scanner`)

Live 200 OK Response Envelope

{
  "ok": true,
  "data": {
    "verdict": "block",
    "risk_score": 55,
    "redacted_text": "Authorization: Bearer [SECRET_STRIPE_KEY_1]",
    "findings": [
      {
        "type": "STRIPE_KEY",
        "severity": "critical",
        "start": 22,
        "end": 61,
        "line": 1,
        "replacement": "[SECRET_STRIPE_KEY_1]",
        "entropy": 4.88,
        "validated": true
      }
    ],
    "counts": {
      "STRIPE_KEY": 1
    },
    "total_secrets": 1,
    "tokens": {
      "[SECRET_STRIPE_KEY_1]": "sk_live_51Nq9abcDEF1234567890ghijklMNOP"
    }
  },
  "meta": {
    "request_id": "req_sec_01",
    "ms": 1
  }
}

Get API Key on RapidAPI Get API Key on Zyla Hub Download OpenAPI 3.0.3 Spec

2. Quickstart Code Examples

Full TypeScript & Python SDK →

curl -X POST "https://api.tinplate.dev/v1/secret-scanner" \
  -H "Content-Type: application/json" \
  -H "X-RapidAPI-Key: YOUR_RAPIDAPI_KEY" \
  -d '{"text":"Authorization: Bearer sk_live_51Nq9abcDEF1234567890ghijklMNOP","redact":true}'

import { TinplateClient } from "@tinplate/sdk"; // npm install @tinplate/sdk

const tinplate = new TinplateClient({
  rapidApiKey: process.env.RAPIDAPI_KEY!,
});

const { data, meta } = await tinplate.call("/v1/secret-scanner", {
  "text": "Authorization: Bearer sk_live_51Nq9abcDEF1234567890ghijklMNOP",
  "redact": true
});
console.log(`[${meta.ms} ms]`, data);

import requests

response = requests.post(
    "https://api.tinplate.dev/v1/secret-scanner",
    headers={
        "Content-Type": "application/json",
        "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
    },
    json={
  "text": "Authorization: Bearer sk_live_51Nq9abcDEF1234567890ghijklMNOP",
  "redact": true
}
)
print(response.json())

const response = await fetch("https://api.tinplate.dev/v1/secret-scanner", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
  },
  body: JSON.stringify({
  "text": "Authorization: Bearer sk_live_51Nq9abcDEF1234567890ghijklMNOP",
  "redact": true
}),
});
const result = await response.json();
console.log(result);

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "tinplate_secret_scanner",
    "arguments": {
      "text": "Authorization: Bearer sk_live_51Nq9abcDEF1234567890ghijklMNOP",
      "redact": true
    }
  }
}

OpenAPI 3.0.3 Schema Contract

Request Parameters & Response Schema Reference

Request Body Parameters (`POST /v1/secret-scanner`)

Parameter	Type & Constraints	Description
`text`required	`string` minLen: 1, maxLen: 262144	Raw log output, .env file, code snippet, or unified git diff to scan.
`mode`optional	`"token" \| "mask" \| "partial"` default: "token"	'token' replaces each unique secret with [SECRET_<TYPE>_<N>] and returns a caller-only map; 'mask' replaces with [REDACTED:<TYPE>]; 'partial' preserves a short prefix/suffix.
`types`optional	`string[]`	Optional allowlist of secret types to scan for. Scans all 18 types when omitted.
`diff_only_added`optional	`boolean` default: false	When true on a unified git diff, ignores removed lines ('-...') and only scans added/context lines.
`min_entropy`optional	`number` min: 2.5, max: 6, default: 3.8	Minimum Shannon entropy (bits/char) required for GENERIC_HIGH_ENTROPY matches.

Response `data` Object Fields (`200 OK`)

Field	Type	Description
`verdict`	`"allow" \| "warn" \| "block"`	Field 'verdict'
`risk_score`	`integer`	Field 'risk_score'
`redacted_text`	`string`	Field 'redacted_text'
`findings`	`object[]`	Field 'findings'
`counts`	`object`	Field 'counts'
`total_secrets`	`integer`	Field 'total_secrets'
`tokens`	`object`	Token-to-secret lookup map (populated only when mode === 'token', never persisted).

3. What Log Redact & Secret Scanner API Detects & Validates

28 secret categories & 38+ high-precision credential signatures: AWS AKIA/ASIA, GitHub ghp_/github_pat_, GitLab glpat-, Stripe sk_live_/rk_live_, Slack xoxb-/xoxp- & webhooks, OpenAI, Anthropic, Google AI/GCP, HuggingFace hf_, SendGrid, Twilio, Mailgun, NPM, PyPI, Docker, Shopify, Databricks, DigitalOcean, Linear, Supabase, Postman, Discord, and Telegram
Cryptographic material & URIs: RSA/EC/DSA/OpenSSH/PGP PEM private keys, JWT tokens, Basic/Bearer Auth headers, and database connection URIs (Postgres, MySQL, MongoDB, Redis, AMQP)
Shannon entropy detector for generic high-entropy assignments (api_key = '...') with false-positive filtering for UUIDs, 40/64-char hex SHAs, SRI hashes, and file paths
Reversible placeholder masking + POST /v1/secret-scanner/restore endpoint

Honest Engineering Boundaries

4. Known Limitations & Test Verification

Release Version: v1.0.7 · Last Verified / Benchmarked: 14 November 2026 · Latency Note: Sub-millisecond figures measure in-Worker V8 compute time (typical client HTTPS network RTT to the nearest Cloudflare PoP is 15–65 ms) · See Full Portfolio Benchmarks & Corpora →

Benchmark v1.0.4 (14 November 2026, 60-case corpus across all 28 secret types + 20 benign logs/UUIDs/SHAs): 100.0% recall (40/40 structured & high-entropy secrets detected, 0 misses), 0.0% false-positive rate (0/20 benign cases flagged), P50 0.051 ms / P99 2.864 ms in deterministic mode.
Near-zero misses on well-defined vendor prefix formats (AWS, GitHub, Stripe, Slack, etc.); generic unprefixed high-entropy detection is heuristic and intentionally tunes out UUIDs, Git SHAs, and lockfile SRI hashes to prevent false positives.
Does not make live outbound calls to vendor APIs to verify whether a leaked key is still active.

5. Marketplace Plans & Payload Quotas

Plan	Monthly Price	Included Requests	Rate Limit	Max Request Payload	Best For
BASIC	$0.00 / month	500 / month (hard limit)	10 req / min	64 KB	Evaluation, local development & CI smoke tests
PRO	$9.99 / month	15,000 / month	60 req / min	128 KB	Solo developers & production apps
ULTRA	$29.99 / month	100,000 / month	300 req / min	256 KB	Growing SaaS & multi-agent pipelines
MEGA	$79.99 / month	500,000 / month	1,000 req / min	256 KB	High-volume enterprise workloads

Subscribe on RapidAPI Subscribe on Zyla Hub Full Pricing Details

6. Frequently Asked Questions

Is it safe to send logs containing secrets to this API?

Tinplate runs with Cloudflare Workers Observability and invocation logging completely disabled (observability.enabled = false). Payloads are processed in volatile memory and immediately garbage-collected.

How does it avoid false positives on UUIDs or Git commit hashes?

UUIDs, 40-char hex git SHAs, CSS hashes, and common lockfile integrity hashes are explicitly filtered before entropy scoring.

Can I use it alongside the PII Redactor API?

Yes—run Secret Scanner on logs/code diffs and PII Redactor on customer support text or combine both before LLM ingestion.

Zero Payload Logging

7. Data Handling, Privacy & Marketplace Proxy Disclosure

Critical security guarantee: scanned secrets and logs exist strictly in volatile V8 memory for ~1 ms and are never logged or stored anywhere.

Worker Zero-Logging Guarantee: Cloudflare Workers Observability and invocation logging are disabled in configuration (observability.enabled = false, head_sampling_rate = 0, invocation_logs = false). Payloads are processed strictly in volatile V8 memory and never logged or stored by Tinplate.

Marketplace Proxies vs. Direct Bearer Key: Requests sent via RapidAPI or Zyla API Hub pass through those marketplaces' proxy infrastructure (subject to their respective privacy policies). Security-sensitive workloads requiring end-to-end zero-intermediary processing can connect directly to https://api.tinplate.dev using a Direct Bearer Key (Authorization: Bearer <API_KEY>). Read our full Privacy Notice and OpenAPI 3.0.3 JSON Schema.