API key format validator
Before you wire a key into an app or paste it into a config, it helps to confirm it is even the right shape — a truncated copy-paste or the wrong provider’s key is a common, frustrating source of 401 errors. This tool checks an API key’s prefix, length, and character set against the documented formats for the major LLM providers, entirely in your browser with no network calls.
How it works
The tool runs your key against a table of provider patterns. Each pattern
specifies a required prefix (such as sk-, sk-ant-, or gsk_), an expected
character set, and a plausible length range. It reports the first provider whose
prefix matches, then verifies the remaining structure and flags any mismatch —
for example a key that starts like an OpenAI key but is far too short to be
valid. OpenAI’s several variants (classic, sk-proj-, and sk-svcacct-) are
distinguished and labeled. Because the check is purely structural, no request is
ever made to any provider.
Tips and notes
- Format is necessary, not sufficient. A well-formed key can still be revoked or scoped wrong; this only rules out obviously broken strings.
- Watch for truncation. The most common failure is a key that lost characters during copy-paste — the length check catches that early.
- Restricted keys are limited. OpenAI
sk-svcacct-and similar restricted keys may lack scopes (for example metering) that your call needs. - Nothing leaves the page. With zero network calls it is safe to validate a production key here.