xAI API Key

Detects xAI (Grok) API keys, which use a distinctive xai- prefix followed by a long alphanumeric body. A leaked key grants unauthorized, billed access to xAI's Grok models and any prompts or data routed through the API.

Type: regex
Engine: universal
Confidence: high
Confidence justification: High confidence: the xai- prefix is distinctive (confirmed by xAI's own security FAQ and its own GitHub secret-scanning partner entry with push protection enabled by default), so false positives on the prefix alone are extremely unlikely even though the exact body length is not formally documented.
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: CIS Controls, ISO 27001, NIST CSF, SOC 2
Data categories: credentials, security
Scope: narrow
Risk rating: 9
Platform compatibility: Purview: Compatible, GCP DLP: Unsupported, Macie: Unsupported, Zscaler: Compatible, Palo Alto: Unsupported, Netskope: Unsupported

Pattern

(?<![A-Za-z0-9_-])xai-[A-Za-z0-9]{20,100}(?![A-Za-z0-9_-])

Corroborative evidence keywords

xai, grok, x.ai, console.x.ai, XAI_API_KEY, api key, api_key, apikey, access key, access token, auth token, authorization, bearer, conn str, connection string, connectionstring, cookie, credential, database, host (+38 more)

Proximity: 300 characters

Should match

xai-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789ABCD — xAI API key, xai- prefix + long alphanumeric body
XAI_API_KEY=xai-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789ABCD — Labelled xAI key in an env assignment
xai-zZyYxXwWvVuUtTsSrRqQpPoOnNmMlLkKjJiIhHgGfFeEdDcCbBaA0123456789 — Mixed-case xAI key body

Should not match

xa-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789ABCD — Wrong prefix (xa- instead of xai-)
xai-ABCDEFGHIJKLMNO — Body far too short (15 chars, below the 20-char floor)
rotate the xai grok api key before deployment — Prose mention without a token value
template example placeholder record identifier — Template/sample context should be excluded even when anchor words are present

Known false positives

Documentation or examples showing placeholder xai- strings. Mitigation: Require corroborative xAI/Grok keywords and check for placeholder markers (example, xxxx).