Replicate API Key

Detects Replicate API tokens, which use a distinctive r8_ prefix followed by a fixed-length body of alphanumerics, underscores, and hyphens. A leaked token grants unauthorized, billed access to Replicate's hosted model inference API and any prompts, images, or data routed through it.

Type: regex
Engine: universal
Confidence: high
Confidence justification: High confidence: the r8_ prefix and exact 40-character total token length are explicitly documented on Replicate's own security/API-tokens page, the body charset ([0-9A-Za-z_-]) is confirmed by TruffleHog's production detector, and Replicate is a confirmed GitHub secret-scanning partner. The exact format enforces at medium confidence; an explicit Replicate label is required for the maximum-rejection high tier.
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: CIS Controls, ISO 27001, NIST CSF, SOC 2
Data categories: credentials, security
Scope: narrow
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Unsupported, Macie: Unsupported, Zscaler: Compatible, Palo Alto: Unsupported, Netskope: Unsupported

Pattern

(?<![0-9A-Za-z_-])r8_[0-9A-Za-z_-]{37}(?![0-9A-Za-z_-])

Corroborative evidence keywords

replicate, replicate.com, api.replicate.com, REPLICATE_API_TOKEN, api key, api_key, apikey, access key, access token, auth token, authorization, bearer, conn str, connection string, connectionstring, cookie, credential, database, host, [object Object] (+37 more)

Proximity: 300 characters

Should match

r8_ABCDEFGHIJKLMNOPQRSTUVWX — Low-tier probe - plausible prefixed candidate with a noncanonical body length
r8_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijk — Medium-tier probe - exact Replicate token structure without nearby vendor context
REPLICATE_API_TOKEN=r8_zZyYxXwWvVuUtTsSrRqQpPoOnNmMlLkKjJiIh — High-tier probe - exact token with an unambiguous Replicate label
Using replicate with token r8_0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZa — Replicate brand mention followed by a token value
r8_ABCDEFGHIJ_KLMNOPQRST-UVWXYZ0123456_- — Token body containing underscores and hyphens (full documented charset)

Should not match

r9_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijk — Wrong prefix (r9_ instead of r8_)
r8_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghij — Body too short (36 chars, below the fixed 37-char length)
remember to rotate the replicate api token before deploying — Prose mention without a token value
Documentation example: REPLICATE_API_TOKEN=r8_zZyYxXwWvVuUtTsSrRqQpPoOnNmMlLkKjJiIh — Exact but explicitly documented example must not enforce

Known false positives

Documentation or examples showing placeholder r8_ strings. Mitigation: Suppress explicit template/example framing; treat an exact bare token as medium and require an unambiguous Replicate label for high confidence.
The common English verb "replicate" (e.g. "replicate this dataset") appearing in text near an unrelated token or hash of similar length. Mitigation: The brand-name keyword term is case-sensitive (Replicate, capitalised) and additional unambiguous terms (replicate.com, REPLICATE_API_TOKEN) disambiguate from the generic verb.

References

Collections

Cloud Credentials & API Keys