API key security
How Pluto Profit API keys are shaped, stored, and how to recognize a leaked key.
Key format
New keys use an issuer-namespaced wire format (industry convention: Anthropic sk-ant-, GitHub ghp_, Shopify shpat_):
| Kind | Prefix | Full form |
|---|---|---|
| Publishable (read-only) | pk_plp_ | pk_plp_ + 64 lowercase hex (32 random bytes) |
| Secret (writes) | sk_plp_ | sk_plp_ + 64 lowercase hex |
| Pixel token (collect only) | pt_plp_ | pt_plp_ + 64 lowercase hex |
plp is the short issuer code for PlutoProfit (short codes avoid brand collisions such as Pluto TV). Underscores (not hyphens) match the rest of the product surface and select as one token on double-click in a terminal.
Keys minted before 2026-07-15 may still use the legacy pk_ prefix. Verification is a SHA-256 of the full plaintext, so legacy keys keep authenticating; only newly minted keys get the namespaced form.
Storage and revocation
Only a SHA-256 hash of the full plaintext is stored. The plaintext is shown once at creation. Deleting a key in the developers UI revokes it immediately.
Secret scanning
Scanners and internal redaction can match Pluto keys with:
\b(sk|pk|pt)_plp_[0-9a-f]{64}\b
This pattern is precise enough for GitHub Secret Scanning and similar partners.