{/* Metadata lives in ./layout.tsx */}

# API key security

How Pluto Profit API keys are shaped, stored, and how to recognize a leaked key. {{ className: 'lead' }}

---

## Key format

New keys use an **issuer-namespaced** wire format (industry convention: Anthropic `sk-ant-`, GitHub `ghp_`, Shopify `shpat_`):

| Kind | Prefix | Full form |
| --- | --- | --- |
| Publishable (read-only) | `pk_plp_` | `pk_plp_` + 64 lowercase hex (32 random bytes) |
| Secret (writes) | `sk_plp_` | `sk_plp_` + 64 lowercase hex |
| Pixel token (collect only) | `pt_plp_` | `pt_plp_` + 64 lowercase hex |

`plp` is the short issuer code for **PlutoProfit** (short codes avoid brand collisions such as Pluto TV). Underscores (not hyphens) match the rest of the product surface and select as one token on double-click in a terminal.

Keys minted before **2026-07-15** may still use the legacy `pk_` prefix. Verification is a SHA-256 of the full plaintext, so legacy keys keep authenticating; only newly minted keys get the namespaced form.

---

## Storage and revocation

Only a SHA-256 hash of the full plaintext is stored. The plaintext is shown once at creation. Deleting a key in the developers UI revokes it immediately.

---

## Secret scanning

Scanners and internal redaction can match Pluto keys with:

```text
\b(sk|pk|pt)_plp_[0-9a-f]{64}\b
```

This pattern is precise enough for GitHub Secret Scanning and similar partners.