#5321·trufflehog

Add Composio API key detector

Author: groovyBugifyCreated Sep 16, 2026Updated Sep 17, 2026

Summary

Request to add a detector for Composio API keys. I work at Composio (composio.dev) and am the point of contact for the key formats; a PR with the detector and pattern tests follows.

Key formats

All three types are a fixed prefix followed by URL-safe nanoid characters [A-Za-z0-9_-], no checksum:

  • project keys: ak_ + 20 characters
  • organization keys: oak_ + 20 characters
  • user keys: uak_ + 43 characters

oak_ and uak_ contain ak_, so the project pattern needs a non-alphabet character before the prefix. Keys can end in -, so \b alone misses about 1 in 64 of them; the patterns use an explicit non-alphabet boundary on both sides.

Verification

Not in the first PR. Composio is finalizing a dedicated verification endpoint and will follow up with a second PR that adds it, plus sanctioned test credentials for the integration test through whichever secure channel you prefer.

Source: trufflesecurity/trufflehog