# APIAcre Secret Scanner

> APIAcre Secret Scanner is a paid API for AI agents from apiacre.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-13).

Scans source code or configuration text for leaked API keys, tokens, and credentials without revealing the actual secret values.

## Facts

- Endpoint: POST https://apiacre.com/v1/developer/secret-scan
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/apiacre-secret-scanner-eea31189
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_iMl2EVof6ppAcd_2yzxFC

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability apiacre-secret-scanner-eea31189 -d '<json body>'
```

Example prompt: Can you scan this source code for any leaked API keys, tokens, or credentials? I want to know what types of secrets are exposed and where, but I don't need to see the actual secret values — just tell me what was found.

## When to prefer this

Choose this endpoint when you need to programmatically audit source code, configuration files, or any text blob for accidentally leaked credentials before committing, deploying, or sharing. It is specifically designed to report secret types and locations without echoing back the secret values, making it safe to use in automated pipelines. Prefer this over general-purpose text analysis tools when the goal is security-focused credential detection with developer context.

## Known failure modes

- Input text is empty or too short to analyze meaningfully
- Obfuscated or encoded secrets may not be detected
- Custom or proprietary token formats may not match known patterns
- Very large inputs may exceed size limits
- False positives may be returned for test/example credentials that resemble real secrets

## How this service works

Detect likely leaked API keys, tokens, private-key headers, JWTs, and credential assignments in caller-supplied source or configuration text. Return type, line, fingerprint, and a fully redacted preview with no network access or code execution.

## Output

Returns a structured list of detected secrets found in the submitted text, including the type of credential (e.g. AWS key, OpenAI token, GitHub token), the location or line context where it was found, and severity or confidence indicators — without returning the actual secret values themselves.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "content": {
   "type": "string",
   "title": "Content",
   "maxLength": 2000000
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {
   "clean": false,
   "findings": [
    {
     "line": 1,
     "type": "generic_assignment",
     "preview": "[REDACTED]",
     "fingerprint": "360b25f697c5fca0"
    }
   ],
   "findingCount": 1
  },
  "meta": {
   "cached": false,
   "sources": [],
   "warnings": [],
   "duration_ms": 42,
   "next_actions": []
  },
  "service": "developer.secret-scan",
  "version": "1",
  "request_id": "018f1f54-7f38-7ba2-8dc3-5f90272d9f1a"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/apiacre-secret-scanner-eea31189/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from apiacre.com](https://www.zero.xyz/host/apiacre.com/llms.txt)