odomojuli / regextokens

list of regex patterns for oauth / api tokens with provided source

Base64

Format

^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{2}==)?$

• How to check whether a string is Base64 encoded or not

Twitter

Access Token

[1-9][0-9]+-[0-9a-zA-Z]{40}

Username

/(^|[^@\w])@(\w{1,15})\b/

Tweets

View source

Facebook

Access Token

EAACEdEose0cBA[0-9A-Za-z]+

• https://grep.app/search?q=EAACEdEose0cBA%5B0-9A-Za-z%5D%2B&regexp=true

OAuth 2.0

[A-Za-z0-9]{125} (counting letters [2])

• https://developers.facebook.com/docs/facebook-login/guides/access-tokens

Instagram

OAuth 2.0

[0-9a-fA-F]{7}.[0-9a-fA-F]{32}

• https://developers.facebook.com/docs/instagram

Username

(?:@)([A-Za-z0-9_](?:(?:[A-Za-z0-9_]|(?:.(?!.))){0,28}(?:[A-Za-z0-9_]))?)

• https://blog.jstassen.com/2016/03/code-regex-for-instagram-username-and-hashtags/

Hashtag

(?:#)([A-Za-z0-9_](?:(?:[A-Za-z0-9_]|(?:.(?!.))){0,28}(?:[A-Za-z0-9_]))?)

• https://blog.jstassen.com/2016/03/code-regex-for-instagram-username-and-hashtags/

Google

API Key

AIza[0-9A-Za-z-_]{35}

OAuth 2.0 Secret Key

[0-9a-zA-Z-_]{24}

• https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_04B-3_Meli_paper.pdf

OAuth 2.0 Auth Code

4/[0-9A-Za-z-_]+

• https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_04B-3_Meli_paper.pdf

OAuth 2.0 Refresh Token

1/[0-9A-Za-z-]{43}|1/[0-9A-Za-z-]{64}

• https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_04B-3_Meli_paper.pdf

OAuth 2.0 Access Token

ya29.[0-9A-Za-z-_]+

• https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_04B-3_Meli_paper.pdf

GitHub

Personal Access Token (Classic)

^ghp_[a-zA-Z0-9]{36}$

• https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens

Personal Access Token (Fine-Grained)

^github_pat_[a-zA-Z0-9]{22}_[a-zA-Z0-9]{59}$

• https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-fine-grained-personal-access-token

OAuth 2.0 Access Token

^gho_[a-zA-Z0-9]{36}$

• https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps

User-to-Server Access Token

^ghu_[a-zA-Z0-9]{36}$

• https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/authenticating-with-a-github-app-on-behalf-of-a-user

Server-to-Server Access Token

^ghs_[a-zA-Z0-9]{36}$

• https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/about-authentication-with-a-github-app#authenticating-as-an-installation

Refresh Token

^ghr_[a-zA-Z0-9]{36}$

Foursquare

Client Key

[0-9a-zA-Z_][5,31]

Secret Key

R_[0-9a-f]{32}

• https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_04B-3_Meli_paper.pdf

Picatic

API Key

sk_live_[0-9a-z]{32}

• https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_04B-3_Meli_paper.pdf

Stripe

Standard API Key

sk_live_[0-9a-zA-Z]{24}

• https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_04B-3_Meli_paper.pdf

Restricted API Key

rk_live_[0-9a-zA-Z]{99}

• Stripe API Keys Documentation

Square

Access Token

sqOatp-[0-9A-Za-z-_]{22}

• https://developer.squareup.com/reference/square/oauth-api/obtaintoken

OAuth Secret

q0csp-[ 0-9A-Za-z-_]{43}

• https://developer.squareup.com/reference/square/oauth-api/obtaintoken

PayPal / Braintree

Access Token

access_token,production$[0-9a-z]{161[0-9a,]{32}

Amazon Marketing Services

Auth Token

amzn.mws.[0-9a-f]{8}-[0-9a-f]{4}-10-9a-f1{4}-[0-9a,]{4}-[0-9a-f]{12}

Twilio

Access Token

55[0-9a-fA-F]{32}

Mailgun

Access Token

key-[0-9a-zA-Z]{32}

MailChimp

Access Token

[0-9a-f]{32}-us[0-9]{1,2}

Slack

OAuth v2 Bot Access Token

xoxb-[0-9]{11}-[0-9]{11}-[0-9a-zA-Z]{24}

• https://api.slack.com/authentication/oauth-v2

OAuth v2 User Access Token

xoxp-[0-9]{11}-[0-9]{11}-[0-9a-zA-Z]{24}

• https://api.slack.com/authentication/oauth-v2

OAuth v2 Configuration Token

xoxe.xoxp-1-[0-9a-zA-Z]{166}

• https://api.slack.com/authentication/rotation

OAuth v2 Refresh Token

xoxe-1-[0-9a-zA-Z]{147}

• https://api.slack.com/authentication/rotation

Webhook

T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}

• https://api.slack.com/messaging/webhooks

Amazon Web Services

Access ID Key

AKIA[0-9A-Z]{16}

Secret Key

[0-9a-zA-Z/+]{40}

Google Cloud Platform

OAuth 2.0

[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}

API Key

[A-Za-z0-9_]{21}--[A-Za-z0-9_]{8}

Heroku

API Key

[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}

• https://devcenter.heroku.com/articles/platform-api-quickstart

OAuth 2.0

[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}

OpenAI

User API Key

sk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}

User Project Key

sk-proj-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}

Service ID

^[A-Za-z0-9]+(-*[A-Za-z0-9]+)*$

Service Key

sk-{SERVICE ID}-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}

regextokens's Issues

Source of `Slack - Access Token` is wrong

https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24} is meaningless.

Maybe:
https://github.com/trufflesecurity/truffleHog/blob/0f223225d6efc8c64504d9381eececb06b14c0e6/scripts/searchOrg.py#L25

Stripe Restricted API Key

Stripe Restricted API Key regex is incorrect, it should be :
regex : "rk_live_[0-9a-zA-Z]{24}"

Need help regarding regexes from Keyhacks repository

There are many other regexes than aforementioned. I need help creating all the regexes from the below repo.

https://github.com/streaak/keyhacks

Please let me know if I can get it.

Markdown Formatting Issues with use of `|` as delimiter for regular expressions

If the regex string contains | then Markdown thinks it's time for a new table entry.

Could probably regulate this issue with a regular expression

In any case, source should defer to .csv regardless of Markdown preview output.

OpenAI Service-ID / Service-Key Format

This is the current expression for service-id:

^[A-Za-z0-9]+(-*[A-Za-z0-9]+)*$

I want to plug in the above expression into the below expression.

This is the current expression for service-key:

sk-{SERVICE ID}-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}

---

service-id can only contain alphanumeric [A-Za-z0-9] or any number of dashes -, but the last character cannot be a dash.
My idea is this:
First, initial chunk is always alphanumeric [A-Za-z0-9] of length 0-to-N.
Then, remaining chunks would be some combination of -, and [A-Za-z0-9].
Finally, the remaining chunks are captured by the greedy quantifier *.

Plugging this into the parent expression causes catastrophic backtracking.
I would like to avoid the recursive or the greedy approach for this reason.

Here are some test strings for service-id:

abc123
abc123-
-abc123
abc-123
abc--123
-abc-123
abc-123-
-abc-123-
-
--

Google OAuth Flow symmetrical across services

Preliminary overview of Google Services indicate OAuth Flow and API Key are symmetrical across various services such as Gmail, Drive, YouTube, Android, etc.

Redundant entries would be tedious to enumerate respective application.

Some entries are not consolidated and entered separately given varying degrees of risk and exposure in standard implementations.

Would appreciate any discussion on how to consolidate approach towards Google services.

Square OAuth flow verification

Added this source for Square Developer:
https://developer.squareup.com/reference/square/oauth-api/obtaintoken

Currently the documentation lists the keys being different character limits than what is currently reflected in the repository.

Regular expression needs to be verified and updated accordingly.

Add source and verification to each regular expression using grep

Came across some regular expression variants in this twitter thread from 2020:
https://twitter.com/avicoder/status/1267857981925765120

Regular expressions may vary in usage but I would like to verify some samples against grep.
Not entirely sure I want to be pointing to existing codebases with real examples, since I find that in poor taste.
Would appreciate suggestions for posting verification of regular expressions.

A number of competing repositories either have invalid or deprecated expressions, this an informal attempt to at least update these sources in one place.

LinkedIn opaque Auth Flow

LinkedIn's API is available in a 2-legged and 3-legged OAuth flow.

Microsoft documentation for LinkedIn:
Authenticating with OAuth 2.0 Overview

Implementing this addition would require including information on single-factor authentication (SFA) and multi-factor authentication (MFA).

GitHub Access Token format

See recent pull request: #12

As of April 5th, 2021:
https://github.blog/2021-04-05-behind-githubs-new-authentication-token-formats/

GitHub has introduced new formats for their personal access tokens (beta).

There should be several additional entries to cover usage.

These include variants that may for example invoke both a pattern for GitHub actions and the fine-grained personal access token associated with it.

Examples should be drawn as much as possible from the documentation.