Groq API Key

Detects Groq (GroqCloud) API keys, which use a distinctive gsk_ prefix followed by a long alphanumeric body. A leaked key grants unauthorized, billed access to Groq's hosted inference API and any prompts or data routed through it.

Type: regex
Engine: universal
Confidence: high
Confidence justification: High confidence: the gsk_ prefix is distinctive and independently confirmed by GitGuardian's detector spec (Prefixed: True), Groq's own GitHub secret-scanning partner entry, and third-party secret-scanning prefix research, so false positives on the prefix alone are extremely unlikely even though the exact body length is not formally documented.
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: CIS Controls, ISO 27001, NIST CSF, SOC 2
Data categories: credentials, security
Scope: narrow
Risk rating: 9
Platform compatibility: Purview: Compatible, GCP DLP: Unsupported, Macie: Unsupported, Zscaler: Compatible, Palo Alto: Unsupported, Netskope: Unsupported

Pattern

(?<![A-Za-z0-9_-])gsk_[A-Za-z0-9]{20,100}(?![A-Za-z0-9_-])

Corroborative evidence keywords

groq, groqcloud, console.groq.com, GROQ_API_KEY, api key, api_key, apikey, access key, access token, auth token, authorization, bearer, conn str, connection string, connectionstring, cookie, credential, database, host, [object Object] (+37 more)

Proximity: 300 characters

Should match

gsk_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789ABCD — Groq API key, gsk_ prefix + long alphanumeric body
GROQ_API_KEY=gsk_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789ABCD — Labelled Groq key in an env assignment
gsk_zZyYxXwWvVuUtTsSrRqQpPoOnNmMlLkKjJiIhHgGfFeEdDcCbBaA0123456789 — Mixed-case Groq key body

Should not match

grk_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789ABCD — Wrong prefix (grk_ instead of gsk_)
gsk_ABCDEFGHIJKLMNO — Body far too short (15 chars, below the 20-char floor)
rotate the groq api key before deployment — Prose mention without a token value
template example placeholder record identifier — Template/sample context should be excluded even when anchor words are present

Known false positives

Documentation or examples showing placeholder gsk_ strings. Mitigation: Require corroborative Groq keywords and check for placeholder markers (example, xxxx).
Co-fires with any generic sk_-family secret detector on the shared body shape, since gsk_ is itself a superset prefix of sk_-style tokens used by other providers. Mitigation: Corroborative Groq-specific keywords (groq, groqcloud, GROQ_API_KEY) disambiguate from other sk_-prefixed providers.