Detect API Keys & Secrets in Text
Detect likely API keys, private keys, JWTs, cloud credentials, and other credential patterns without returning the secret values in findings.
When to use it
Use this on logs, configuration snippets, retrieved text, support tickets, code blocks, or agent context before it is transmitted or stored elsewhere. Findings contain type and character positions rather than echoing secret values.
Important limitation
Pattern detection is not guaranteed to find every secret. Custom credential formats may require application-specific rules.
Use it in your browser
The browser version runs locally on your device.
Open the tool →Use it from an agent or application
POST https://api.scrubmytext.com/v1/detect-secrets
MCP tool name: detect_secrets. Paid API tools use a bearer API key; inspect_text is also available on the free API tier.