---
title: Secret Validation
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > Code Security > Secret Scanning > Secret Validation
---

# Secret Validation

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## About validity checks{% #about-validity-checks %}

For certain detections (see the list below), Datadog checks whether a detected secret is valid during scans. For these live validation checks, Datadog makes API requests to provider endpoints to confirm that a credential is active. Datadog only makes requests to endpoints that do not return sensitive data or personally identifiable information (PII), and only to verify if the credential can still access the provider endpoint.

For secret types with validation available, Datadog displays the validation status in the explorer as "Active" or "Inactive". You can also filter or query detections by their Validation Status.

For some secret types, Datadog uses static validation methods, such as computing a checksum, to confirm that a detected secret is not a false positive. Static validation results are not displayed and all references to "validation" in the explorer correspond to live validation results.

## List of supported validators{% #list-of-supported-validators %}

| Secret Type                                   | Live Validator |
| --------------------------------------------- | -------------- |
| `1password_service_account_key`               | No             |
| `aba_routing_number`                          | No             |
| `aws_access_key_id`                           | Yes            |
| `aws_secret_access_key`                       | Yes            |
| `adafruit_io_key`                             | Yes            |
| `adobe_api_key`                               | No             |
| `adobe_access_token`                          | Yes            |
| `adobe_client_secret`                         | No             |
| `adobe_refresh_token`                         | No             |
| `aikido_api_client_secret`                    | No             |
| `aikido_broker_token`                         | No             |
| `aikido_ci_scanning_token`                    | Yes            |
| `aikido_rest_api_access_token`                | No             |
| `airtable_personal_access_token`              | Yes            |
| `aiven_default_service_password`              | No             |
| `aiven_personal_token`                        | Yes            |
| `amazon_mws_token`                            | No             |
| `american_express_credit_card`                | No             |
| `american_express_credit_card`                | No             |
| `american_express_credit_card`                | No             |
| `american_express_credit_card`                | No             |
| `claude_api_key`                              | Yes            |
| `apify_api_token`                             | Yes            |
| `apify_proxy_password`                        | No             |
| `apify_ui_token`                              | Yes            |
| `asana_oauth_token`                           | Yes            |
| `asana_personal_access_token`                 | Yes            |
| `atlassian_api_token`                         | No             |
| `atlassian_access_token`                      | Yes            |
| `atlassian_client_secret`                     | No             |
| `atlassian_refresh_token`                     | No             |
| `austria_ssn`                                 | No             |
| `azure_ai_services_key`                       | No             |
| `azure_api_management_direct_management_key`  | No             |
| `azure_appconfig_connection_key`              | No             |
| `azure_batch_account_key`                     | No             |
| `azure_bot_service_app_secret`                | No             |
| `azure_cache_for_redis_connection_string`     | No             |
| `azure_container_registry_admin_key`          | No             |
| `azure_container_registry_key`                | No             |
| `azure_cosmosdb_connection_key`               | No             |
| `azure_devops_access_token`                   | No             |
| `azure_entra_client_secret`                   | No             |
| `azure_entra_id_token`                        | Yes            |
| `azure_event_grid_access_key`                 | No             |
| `azure_event_hub_connection_string`           | No             |
| `azure_fluid_relay_key`                       | No             |
| `azure_function_key`                          | No             |
| `azure_iot_device_connection_string`          | No             |
| `azure_iot_device_key`                        | No             |
| `azure_iot_provisioning_connection_string`    | No             |
| `azure_iot_hub_connection_string`             | No             |
| `azure_iot_hub_key`                           | No             |
| `azure_logic_apps_sas_url`                    | No             |
| `azure_ml_inference_endpoint_key`             | No             |
| `azure_maps_subscription_key`                 | Yes            |
| `azure_openai_key`                            | No             |
| `azure_quantum_api_key`                       | No             |
| `azure_relay_connection_string`               | No             |
| `azure_sql_connection_string_password`        | No             |
| `azure_search_admin_key`                      | No             |
| `azure_service_bus_connection_string`         | No             |
| `azure_shared_access_signature`               | No             |
| `azure_signalr_access_key`                    | No             |
| `azure_storage_account_key`                   | No             |
| `azure_subscription_key`                      | No             |
| `azure_web_pub_sub_connection_string`         | No             |
| `beamer_api_token`                            | Yes            |
| `bearer_token`                                | No             |
| `belgium_personal_id`                         | No             |
| `bitbucket_access_token`                      | No             |
| `bitbucket_client_secret`                     | No             |
| `bitbucket_oauth_access_token`                | Yes            |
| `bitbucket_oauth_refresh_token`               | No             |
| `bitcoin_wallet_address`                      | No             |
| `brazilian_cnpj`                              | No             |
| `brazilian_cpf`                               | No             |
| `buildkite_access_token`                      | Yes            |
| `buildkite_agent_session_token`               | Yes            |
| `buildkite_cluster_token`                     | Yes            |
| `buildkite_portal_secret`                     | No             |
| `buildkite_portal_token`                      | No             |
| `buildkite_registry_token`                    | No             |
| `buildkite_temporary_registry_token`          | No             |
| `buildkite_agent_token`                       | Yes            |
| `bulgaria_personal_id`                        | No             |
| `canada_sin`                                  | No             |
| `cfx_re_registration_key`                     | No             |
| `checkout_secret`                             | No             |
| `china_passport`                              | No             |
| `china_phone_number`                          | No             |
| `china_personal_id`                           | No             |
| `china_vin`                                   | No             |
| `china_vehicle_plate`                         | No             |
| `circleci_personal_access_token`              | Yes            |
| `circleci_project_access_token`               | Yes            |
| `cloudflare_api_token`                        | Yes            |
| `cloudflare_global_api_key`                   | No             |
| `cloudflare_origin_ca_key`                    | Yes            |
| `cohere_api_key`                              | Yes            |
| `contentful_access_token`                     | Yes            |
| `crates_io_api_key`                           | No             |
| `croatia_health_insurance`                    | No             |
| `croatia_personal_id`                         | No             |
| `cyprus_personal_id`                          | No             |
| `cyprus_tax_id`                               | No             |
| `czechia_personal_id`                         | No             |
| `czechia_tax_id`                              | No             |
| `databricks_personal_access_token`            | No             |
| `databricks_session_token`                    | No             |
| `datadog_api_key`                             | Yes            |
| `datadog_application_key`                     | No             |
| `datadog_nonce_session_token`                 | No             |
| `datadog_oauth_token`                         | No             |
| `datadog_personal_access_token`               | Yes            |
| `datadog_application_key`                     | No             |
| `deepseek_api_key`                            | Yes            |
| `digitalocean_oauth_token`                    | No             |
| `digitalocean_personal_access_token`          | Yes            |
| `diners_credit_card`                          | No             |
| `diners_credit_card`                          | No             |
| `diners_credit_card`                          | No             |
| `diners_credit_card`                          | No             |
| `discord_application_oauth_access_token`      | Yes            |
| `discord_application_oauth_secret_key`        | No             |
| `discord_application_token`                   | Yes            |
| `discord_bot_token`                           | Yes            |
| `discord_webhook_code`                        | No             |
| `discover_credit_card`                        | No             |
| `discover_credit_card`                        | No             |
| `discover_credit_card`                        | No             |
| `docker_access_token`                         | Yes            |
| `docker_organization_access_token`            | No             |
| `docker_personal_access_token`                | No             |
| `docker_swarm_join_token`                     | No             |
| `docker_swarm_unlock_key`                     | No             |
| `doppler_access_token`                        | Yes            |
| `dropbox_access_token`                        | Yes            |
| `duffel_test_access_token`                    | Yes            |
| `dynatrace_token`                             | No             |
| `crypto_wallet_address`                       | No             |
| `easypost_api_key`                            | No             |
| `elastic_api_key`                             | Yes            |
| `estonia_personal_id`                         | No             |
| `facebook_access_token`                       | No             |
| `fastly_api_token`                            | Yes            |
| `figma_personal_access_token`                 | No             |
| `finland_personal_id`                         | No             |
| `flutterwave_api_secret_key`                  | Yes            |
| `frame_io_developer_token`                    | Yes            |
| `frame_io_oauth_secret`                       | No             |
| `frame_io_oauth_session_secret`               | Yes            |
| `france_ssn`                                  | No             |
| `france_tax_id`                               | No             |
| `generic_json_web_token`                      | No             |
| `germany_drivers_license`                     | No             |
| `germany_personal_id`                         | No             |
| `germany_ssn`                                 | No             |
| `germany_tax_id`                              | No             |
| `github_access_token`                         | Yes            |
| `github_personal_access_token`                | Yes            |
| `github_refresh_token`                        | No             |
| `gitlab_application_oauth_secret`             | No             |
| `gitlab_deploy_token`                         | No             |
| `gitlab_token`                                | Yes            |
| `google_api_key`                              | Yes            |
| `google_client_secret`                        | No             |
| `gcp_service_account_api_key`                 | Yes            |
| `gcp_oauth_access_token`                      | No             |
| `google_cloud_storage_access_key_id`          | No             |
| `google_cloud_storage_access_key_secret`      | No             |
| `google_oauth_access_token`                   | Yes            |
| `grafana_cloud_access_token`                  | No             |
| `grafana_service_account_token`               | No             |
| `greece_personal_id`                          | No             |
| `greece_ssn`                                  | No             |
| `greece_tax_id`                               | No             |
| `groq_api_key`                                | Yes            |
| `basic_auth`                                  | No             |
| `cookie`                                      | No             |
| `http_url`                                    | No             |
| `vault_token`                                 | No             |
| `heroku_api_key`                              | Yes            |
| `highnote_restricted_live_api_key`            | No             |
| `highnote_restricted_test_api_key`            | No             |
| `highnote_secret_live_api_key`                | No             |
| `highnote_secret_test_api_key`                | No             |
| `hubspot_developer_api_key`                   | Yes            |
| `hubspot_personal_access_key`                 | No             |
| `hugging_face_access_token`                   | Yes            |
| `hugging_face_organization_api_token`         | Yes            |
| `human_name`                                  | No             |
| `hungary_personal_id`                         | No             |
| `hungary_ssn`                                 | No             |
| `hungary_tax_id`                              | No             |
| `ipv4_address`                                | No             |
| `ipv6_address`                                | No             |
| `india_aadhaar`                               | No             |
| `instagram_token`                             | No             |
| `intercom_access_token`                       | Yes            |
| `ionic_personal_access_token`                 | No             |
| `ireland_personal_id`                         | No             |
| `italy_personal_id`                           | No             |
| `jcb_credit_card`                             | No             |
| `jcb_credit_card`                             | No             |
| `jcb_credit_card`                             | No             |
| `jfrog_platform_access_token`                 | No             |
| `jfrog_platform_reference_token`              | No             |
| `jira_api_token`                              | No             |
| `langchain_personal_access_token`             | Yes            |
| `langchain_service_key`                       | Yes            |
| `lark_app_secret`                             | No             |
| `lark_tenant_access_token`                    | Yes            |
| `lark_user_grant_token`                       | Yes            |
| `lark_user_session_token`                     | No             |
| `latvia_personal_id`                          | No             |
| `launchdarkly_access_token`                   | Yes            |
| `lichess_personal_access_token`               | Yes            |
| `linear_api_key`                              | Yes            |
| `linkedin_secret`                             | No             |
| `linkedin_token`                              | No             |
| `lithuania_personal_id`                       | No             |
| `luxembourg_personal_id`                      | No             |
| `maestro_debit_card`                          | No             |
| `maestro_debit_card`                          | No             |
| `maestro_debit_card`                          | No             |
| `mailchimp_api_key`                           | No             |
| `mailgun_api_key`                             | No             |
| `mailgun_api_key_v2`                          | No             |
| `malta_personal_id`                           | No             |
| `mapbox_secret_access_token`                  | Yes            |
| `mastercard_credit_card`                      | No             |
| `mastercard_credit_card`                      | No             |
| `mastercard_credit_card`                      | No             |
| `maxmind_license_key`                         | Yes            |
| `mistral_api_key`                             | Yes            |
| `monero_wallet_address`                       | No             |
| `mongodb_uri_with_credentials`                | No             |
| `npm_access_token`                            | Yes            |
| `navercloud_access_key`                       | No             |
| `navercloud_access_key_secret`                | No             |
| `navercloud_sts`                              | No             |
| `navercloud_sts_secret`                       | No             |
| `netherlands_personal_id`                     | No             |
| `notion_integration_token`                    | Yes            |
| `nuget_api_key`                               | No             |
| `octopus_deploy_api_key`                      | No             |
| `okta_api_token`                              | No             |
| `openai_admin_api_key`                        | No             |
| `openai_legacy_api_key`                       | Yes            |
| `openai_named_project_api_key`                | Yes            |
| `openai_project_api_key`                      | Yes            |
| `openai_service_account_api_key`              | Yes            |
| `openai_user_api_key`                         | Yes            |
| `openrouter_api_key`                          | Yes            |
| `oracle_api_signing_key`                      | No             |
| `oracle_access_token`                         | No             |
| `oracle_auth_token`                           | No             |
| `oracle_customer_secret_key`                  | No             |
| `pgp_private_key`                             | No             |
| `pkcs_8_private_key`                          | No             |
| `pagerduty_api_token`                         | Yes            |
| `pagerduty_oauth_classic_secret`              | No             |
| `pagerduty_oauth_scoped_secret`               | No             |
| `passport`                                    | No             |
| `paypal_braintree_access_token`               | No             |
| `perfect_cloud_api_key`                       | Yes            |
| `perplexity_api_key`                          | No             |
| `poland_personal_id`                          | No             |
| `poland_tax_id`                               | No             |
| `polar_access_token`                          | Yes            |
| `polar_authorization_code`                    | No             |
| `polar_client_registration_token`             | No             |
| `polar_client_secret`                         | No             |
| `polar_customer_session_token`                | Yes            |
| `polar_personal_access_token`                 | Yes            |
| `polar_refresh_token`                         | No             |
| `polar_user_session_token`                    | Yes            |
| `portugal_ssn`                                | No             |
| `portugal_tax_id`                             | No             |
| `postman_api_key`                             | Yes            |
| `pulumi_access_token`                         | Yes            |
| `pypi_upload_token`                           | No             |
| `rsa_private_key`                             | No             |
| `ramp_business_oauth_token`                   | Yes            |
| `ramp_client_secret`                          | No             |
| `ramp_user_oauth_token`                       | Yes            |
| `romania_personal_id`                         | No             |
| `rubygems_api_key`                            | Yes            |
| `ssh_key`                                     | No             |
| `salesforce_access_token`                     | No             |
| `salesforce_jwt_access_token`                 | No             |
| `salesforce_oauth2_consumer_key`              | No             |
| `salesforce_oauth2_consumer_secret`           | No             |
| `send_grid_api_token`                         | Yes            |
| `sentry_organization_token`                   | Yes            |
| `sentry_personal_token`                       | Yes            |
| `shippo_api_key`                              | Yes            |
| `shippo_jwt`                                  | Yes            |
| `shopify_shared_secret`                       | No             |
| `shopify_access_token`                        | No             |
| `shopify_cli_token`                           | No             |
| `shopify_partner_api_token`                   | No             |
| `slack_access_token`                          | Yes            |
| `slack_webhook_secret`                        | No             |
| `slovenia_personal_id`                        | No             |
| `slovenia_tax_id`                             | No             |
| `snowflake_personal_access_token`             | No             |
| `spain_personal_id`                           | No             |
| `spain_ssn`                                   | No             |
| `square_access_token`                         | No             |
| `square_oauth_secret`                         | No             |
| `square_personal_access_token`                | Yes            |
| `email_address`                               | No             |
| `iban_code`                                   | No             |
| `mac_address`                                 | No             |
| `stripe_restricted_api_key`                   | Yes            |
| `stripe_api_key`                              | Yes            |
| `stripe_webhook_signing_secret`               | No             |
| `supabase_experimental_personal_access_token` | Yes            |
| `supabase_legacy_service_key`                 | No             |
| `supabase_oauth_access_token`                 | Yes            |
| `supabase_oauth_client_secret`                | No             |
| `supabase_personal_access_token`              | Yes            |
| `supabase_secret_key`                         | No             |
| `sweden_coordination_number`                  | No             |
| `sweden_personal_id`                          | No             |
| `tableau_personal_access_token`               | No             |
| `telegram_bot_token`                          | No             |
| `tencent_cloud_sts_session_token`             | No             |
| `tencent_cloud_secret_id`                     | No             |
| `tencent_cloud_secret_key`                    | No             |
| `terraform_api_token`                         | Yes            |
| `twilio_api_key`                              | No             |
| `twilio_api_secret`                           | No             |
| `twilio_access_token`                         | No             |
| `twilio_account_sid`                          | No             |
| `twilio_auth_token`                           | No             |
| `twitter_secret`                              | No             |
| `typeform_personal_access_token`              | Yes            |
| `uk_nhs`                                      | No             |
| `uk_nin`                                      | No             |
| `us_dea_number`                               | No             |
| `us_driver_license`                           | No             |
| `us_npi_number`                               | No             |
| `passport`                                    | No             |
| `us_ssn`                                      | No             |
| `us_tax_id`                                   | No             |
| `us_vin`                                      | No             |
| `vercel_ai_gateway_api_key`                   | Yes            |
| `vercel_app_access_token`                     | No             |
| `vercel_app_refresh_token`                    | No             |
| `vercel_integration_token`                    | No             |
| `vercel_personal_access_token`                | Yes            |
| `visa_credit_card`                            | No             |
| `visa_credit_card`                            | No             |
| `visa_credit_card`                            | No             |
| `wakatime_api_key`                            | No             |
| `wechat_pay_api_key`                          | No             |
| `workos_api_key`                              | Yes            |
| `yandex_cloud_api_key`                        | No             |
| `yandex_cloud_iam_access_secret`              | No             |
| `yandex_cloud_iam_cookie`                     | No             |
| `yandex_cloud_iam_token`                      | No             |
| `yandex_cloud_smartcaptcha_server_key`        | No             |
| `yandex_legacy_dictionary_api_key`            | No             |
| `yandex_legacy_predictor_api_key`             | No             |
| `yandex_legacy_translate_api_key`             | No             |
| `yandex_passport_oauth_token`                 | Yes            |
| `xai_grok_api_key`                            | Yes            |
Live ValidatorAll No Yes