LangSmith API Key

Detects LangSmith API keys (personal access tokens and service keys), which use a distinctive lsv2_pt_ or lsv2_sk_ prefix followed by a hyphenated hex body. A leaked key grants unauthorized access to LangSmith trace data -- which can include full LLM prompts and completions -- and billed access to the LangSmith/LangChain platform.

Type: regex
Engine: universal
Confidence: high
Confidence justification: High confidence: the lsv2_pt_/lsv2_sk_ prefixes are documented by LangChain, LangSmith keys are GitHub secret-scanning partner entries, and the 32-hex-underscore-10-hex structure is independently observed. The exact format enforces at medium confidence; an explicit LangSmith/LangChain label is required for the maximum-rejection high tier.
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: CIS Controls, ISO 27001, NIST CSF, SOC 2
Data categories: credentials, security
Scope: narrow
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Unsupported, Macie: Unsupported, Zscaler: Compatible, Palo Alto: Unsupported, Netskope: Unsupported

Pattern

(?<![A-Za-z0-9_])lsv2_(?:pt|sk)_[0-9a-fA-F]{32}_[0-9a-fA-F]{10}(?![A-Za-z0-9_-])

Corroborative evidence keywords

langsmith, langchain, smith.langchain.com, LANGSMITH_API_KEY, api key, api_key, apikey, access key, access token, auth token, authorization, bearer, conn str, connection string, connectionstring, cookie, credential, database, host, [object Object] (+37 more)

Proximity: 300 characters

Should match

lsv2_pt_0123456789abcdef01234567 — Low-tier probe - plausible prefixed candidate with an incomplete body
lsv2_pt_0123456789abcdef0123456789abcdef_0123456789 — Medium-tier probe - exact LangSmith token structure without nearby vendor context
LANGSMITH_API_KEY=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 — High-tier probe - exact service key with an unambiguous LangSmith label
Using langsmith with key lsv2_pt_ABCDEF0123456789ABCDEF0123456789_ABCDEF0123 — LangSmith brand mention followed by a mixed-case hex token value

Should not match

ls__0123456789abcdef0123456789abcdef_0123456789 — Legacy ls__ prefix, rejected by v2 tracing and not a current lsv2_ key
lsv2_pt_0123456789abcdef012345678abcd_0123456789 — First hex segment too short (29 chars, not 32)
dont forget to rotate the langsmith api key — Prose mention without a token value
Documentation example: LANGSMITH_API_KEY=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 — Exact but explicitly documented example must not enforce

Known false positives

Documentation or examples showing placeholder lsv2_pt_/lsv2_sk_ strings. Mitigation: Suppress explicit template/example framing; treat an exact bare token as medium and require an unambiguous LangSmith/LangChain label for high confidence.
Legacy ls__-prefixed LangChain API keys (pre-v2, superseded October 2024) are a different, older format not matched by this pattern. Mitigation: Documented as a known scope limitation; legacy ls__ keys are out of scope for this pattern.

References

Collections

Cloud Credentials & API Keys