Skip to main content
POST
Report a leaked API key
This endpoint needs no authentication. It always answers 202 with the same body, so it cannot be used to check whether a key is valid.

Body

application/json
token
string
required

The leaked key as found.

Maximum string length: 4096
source
string

Where it was found, such as github.

Maximum string length: 64
reporter_email
string
Maximum string length: 320
evidence_url
string<uri>
Maximum string length: 2048
comment
string
Maximum string length: 2000

Response

202 - application/json

Report received

status
enum<string>
Available options:
received
Last modified on October 28, 2026