//Live-key verification
A leaked key isn’t a finding until you know it still works.
Every secret scanner can find a string that looks like an API key. Regexes for that have been public for a decade. The hard part was never detection, it’s that a detection on its own tells you almost nothing.
The problem with pattern-matching
Consider two findings, both reported CRITICAL. The first is a Stripe key rotated eight months ago, sitting in an old bundle nobody redeployed. The second is a Supabase service_role key that works right now and bypasses every row-level security policy you have. Pattern-matching cannot tell them apart, so most tools report both identically.
The developer opens the report, checks the first one, finds it dead, and learns that this tool cries wolf. That’s the real failure mode: not a missed vulnerability, a lost reader.
64% of secrets leaked in 2022 were still valid years later, not because anyone decided they were safe, but because nobody knew which ones mattered enough to act on.
GitGuardian, State of Secrets Sprawl 2026
Asking the only authority that knows
Exactly one system can say whether a credential is live: the one that issued it. So when Flare.ai finds a key, it asks, with a single read-only identity request to that provider, and to nobody else.
Airtable
Anthropic
Discord
GitHub
Google
Groq
Hugging Face
Linear
Mapbox
Notion
npm
OpenAI
Replicate
Resend
SendGrid
Slack
Stripe
Supabase
TelegramNone of these are billable. None of them write anything. They’re the cheapest “who am I” endpoint each provider offers, which is the point: verification shouldn’t cost the victim anything.
Every probe, in full
All 19 of them, and the exact request each one sends. Published because a claim about what we do to your credentials is worth nothing if you have to take it on trust, and because this table is generated from the code that runs, not written alongside it.
| Provider | Probe |
|---|---|
| Airtable | GET https://api.airtable.com/v0/meta/whoami |
| Anthropic | GET https://api.anthropic.com/v1/models |
| Discord | GET https://discord.com/api/v10/users/@me |
| GitHub | GET https://api.github.com/user |
| GET https://maps.googleapis.com/maps/api/geocode/json | |
| Groq | GET https://api.groq.com/openai/v1/models |
| Hugging Face | GET https://huggingface.co/api/whoami-v2 |
| Linear | POST https://api.linear.app/graphql { viewer { id } } |
| Mapbox | GET https://api.mapbox.com/tokens/v2 |
| Notion | GET https://api.notion.com/v1/users/me |
| npm | GET https://registry.npmjs.org/-/whoami |
| OpenAI | GET https://api.openai.com/v1/models |
| Replicate | GET https://api.replicate.com/v1/account |
| Resend | GET https://api.resend.com/domains |
| SendGrid | GET https://api.sendgrid.com/v3/scopes |
| Slack | POST https://slack.com/api/auth.test |
| Stripe | GET https://api.stripe.com/v1/account |
| Supabase | GET https://<project-ref>.supabase.co/rest/v1/ |
| Telegram | GET https://api.telegram.org/bot<token>/getMe |
What the answer changes
Live
Critical · CVSS 9.8 · high confidenceThe provider accepted the key. It works right now, and it is readable by anyone who views your bundle. Rotate it before you do anything else.
Revoked
Medium · CVSS 4.3 · high confidenceThe provider rejected it. Still shouldn't be in your bundle, the next key that lands there will leak the same way, but nobody needs paging at 2am.
Unverified
Graded on format aloneNo safe read-only endpoint exists for that credential type, or the check was inconclusive. Labelled as unverified rather than dressed up as a maybe.
That middle row is the one that earns trust. A tool willing to tell you something is less serious than it looks is a tool you believe when it says something is worse.
The keys we refuse to verify
An AWS access key ID can’t be verified without the paired secret access key. We only ever recover the ID from a bundle, and we have no interest in holding the other half. So AWS findings stay unverified, permanently and on purpose.
Being able to say “we don’t know” is a feature. A scanner that guesses to fill a column will eventually guess wrong about something that matters.
Turning it off
If you’d rather no credential ever left your infrastructure, not even to its own issuer, set this. Every finding then degrades to unverified:
FLARE_DISABLE_SECRET_VERIFICATION=1
Find out which of your keys still work.
One free scan per site. No account, under a minute.