Secret Verification Providers - Cysmiq

Overview

When a secret is detected, Cysmiq can run a provider check to determine whether it is still active. This page lists active secret credential families Cysmiq detects today and whether a provider check is supported.

Supported providers

Cysmiq currently detects 110 active secret credential families across 81 providers. Verification is supported for 94 credential families and not supported for 16.

Provider	Credential family	Verification supported
AbuseIPDB	API key	Yes
Abyssale	API key	Yes
Adafruit	Adafruit IO key	Yes
Agora	Customer ID and customer secret	Yes
AI21	API key	Yes
Airbrake	User API key	Yes
Airtable	OAuth integrations	No
Airtable	Personal access tokens	Yes
Aiven	Application tokens	Yes
Aiven	Personal tokens	Yes
Alchemy	API key	Yes
Anthropic	Admin API key	Yes
Anthropic	API key	Yes
Apify	Organization API tokens	Yes
Apify	Personal API tokens	Yes
Apollo	API key	Yes
Apollo	OAuth client secret	No
Asana	Client ID and client secret	No
Asana	Personal access token	Yes
AssemblyAI	API key	Yes
AWS	Access keys	Yes
Beamer	API key	Yes
Bitkub	API key	Yes
Chargebee	Full-access key	Yes
Chargebee	Read-only key	Yes
CircleCI	Personal API tokens	Yes
Cloudflare	Account API token	Yes
Cloudflare	Global API key	Yes
Cloudflare	Origin CA key	Yes
Cloudflare	R2 Account API token	No
Cloudflare	R2 User API token	No
Cloudflare	Service token	No
Cloudflare	User API token	Yes
Cloudinary	API key and API secret	Yes
Code Climate	Personal access token	Yes
Cohere	API key	Yes
crates.io	API token	No
Databricks	Personal access token	Yes
DeepSeek	API key	Yes
DigitalOcean	OAuth application	No
DigitalOcean	Personal access token	Yes
DocuSign	Integration key	No
Dropbox	Access token	Yes
Duffel	Access token	Yes
EasyPost	API keys	Yes
GitHub	Fine-grained personal access token	Yes
Google APIs	Standard API key	Yes
Groq	Project API key	Yes
Heroku	API key	Yes
HubSpot	Developer API key	Yes
Hunter	API key	Yes
Infura	API key	Yes
Intercom	Access token	Yes
Jenkins	API token	Yes
JFrog	Access token	Yes
Langfuse	API credentials	Yes
Linear	Personal API keys	Yes
Mailchimp	API key	Yes
Mailgun	Account API keys	Yes
Mailjet	API key	Yes
Mapbox	Secret token	Yes
Microsoft Teams	Incoming webhook	Yes
Midtrans	Server key	Yes
Mistral AI	API key	Yes
MuleSoft	App acts on behalf of a user	No
MuleSoft	App acts on its own behalf (client credentials)	Yes
MuleSoft	Environment credentials	Yes
MuleSoft	Organization credentials	Yes
Netlify	Personal access token	Yes
npm	Granular access token	Yes
NuGet	Scoped API keys	Yes
Nylas	API key	Yes
OpenAI	Personal API key	Yes
OpenAI	Project API key	Yes
OpenRouter	API key	Yes
OpenRouter	Management API key	Yes
OpenWeatherMap	API key	Yes
Paystack	API keys	Yes
Perplexity AI	API key	Yes
Polygon.io	API key	Yes
Postman	Postman API key	Yes
Postmark	Account API token	Yes
Postmark	Server API token	Yes
Postmark	SMTP token	No
RapidAPI	Rapid API key	Yes
Replicate	API token	Yes
Replicate	Signing secret	No
Resend	API key	Yes
RubyGems	API key	Yes
SendGrid	API key	Yes
Shodan	API key	Yes
Slack	Incoming webhook URL	Yes
SonarCloud	Personal access tokens	Yes
Square	OAuth access token	Yes
Square	Personal access token	Yes
Square	Sandbox access token	No
SSLMate	API key	Yes
StackHawk	API key	Yes
Stripe	Restricted API key	Yes
Stripe	Secret API key	Yes
SurgeAI	API key	Yes
Tailscale	API access tokens	Yes
Tailscale	Auth keys	No
Tailscale	OAuth clients	Yes
Tailscale	SCIM API keys	No
Tailscale	Webhook secret	No
Tavily	API key	Yes
Telegram	Bot token	Yes
Travis	API access token	Yes
Vercel	Access token	Yes

Context assessment

Secrets without provider check support use a context assessment. This includes:

High-entropy tokens in configuration files
Generic API key patterns
Private keys and certificates
Provider-ambiguous credentials

The assessment reviews the detection and its source context to help determine whether the finding is actionable or needs further investigation.