Replicate API Key

Detects Replicate API tokens, which use a distinctive r8_ prefix followed by a fixed-length body of alphanumerics, underscores, and hyphens. A leaked token grants unauthorized, billed access to Replicate's hosted model inference API and any prompts, images, or data routed through it.

Type: regex
Engine: universal
Confidence: high
Confidence justification: High confidence: the r8_ prefix and exact 40-character total token length are explicitly documented on Replicate's own security/API-tokens page, the body charset ([0-9A-Za-z_-]) is confirmed by TruffleHog's production Replicate detector, and Replicate is a confirmed GitHub secret-scanning partner (replicate_api_token), so false positives on the prefix+length+charset combination alone are extremely unlikely.
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: CIS Controls, ISO 27001, NIST CSF, SOC 2
Data categories: credentials, security
Scope: narrow
Risk rating: 9
Platform compatibility: Purview: Compatible, GCP DLP: Unsupported, Macie: Unsupported, Zscaler: Compatible, Palo Alto: Unsupported, Netskope: Unsupported

Pattern

(?<![0-9A-Za-z_-])r8_[0-9A-Za-z_-]{37}(?![0-9A-Za-z_-])

Corroborative evidence keywords

replicate, replicate.com, api.replicate.com, REPLICATE_API_TOKEN, api key, api_key, apikey, access key, access token, auth token, authorization, bearer, conn str, connection string, connectionstring, cookie, credential, database, host, [object Object] (+37 more)

Proximity: 300 characters

Should match

r8_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijk — Replicate API token, r8_ prefix + 37-char alphanumeric body
REPLICATE_API_TOKEN=r8_zZyYxXwWvVuUtTsSrRqQpPoOnNmMlLkKjJiIh — Labelled Replicate token in an env assignment
Using replicate with token r8_0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZa — Replicate brand mention followed by a token value
r8_ABCDEFGHIJ_KLMNOPQRST-UVWXYZ0123456_- — Token body containing underscores and hyphens (full documented charset)

Should not match

r9_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijk — Wrong prefix (r9_ instead of r8_)
r8_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghij — Body too short (36 chars, below the fixed 37-char length)
remember to rotate the replicate api token before deploying — Prose mention without a token value
template example placeholder record identifier — Template/sample context should be excluded even when anchor words are present

Known false positives

Documentation or examples showing placeholder r8_ strings. Mitigation: Require corroborative Replicate keywords and check for placeholder markers (example, xxxx).
The common English verb "replicate" (e.g. "replicate this dataset") appearing in text near an unrelated token or hash of similar length. Mitigation: The brand-name keyword term is case-sensitive (Replicate, capitalised) and additional unambiguous terms (replicate.com, REPLICATE_API_TOKEN) disambiguate from the generic verb.