KeyHacks shows ways in which particular API keys found on a Bug Bounty Program can be used, to check if they are valid.
@Gwen001 has scripted the entire process available here and it can be found here
Table of Contents
github.com/gwen001/pentest-tools/blob/master/keyhacks.sh
github.com/streaak/keyhacks#ABTasty-API-Key
github.com/streaak/keyhacks#Algolia-API-key
github.com/streaak/keyhacks#Amplitude-API-Keys
github.com/streaak/keyhacks#Asana-Access-Token
github.com/streaak/keyhacks#AWS-Access-Key-ID-and-Secret
github.com/streaak/keyhacks#Azure-Application-Insights-APP-ID-and-API-Key
github.com/streaak/keyhacks#Bing-Maps-API-Key
github.com/streaak/keyhacks#Bitly-Access-token
github.com/streaak/keyhacks#BranchIO-Key-and-Secret
github.com/streaak/keyhacks#BrowserStack-Access-Key
github.com/streaak/keyhacks#Buildkite-Access-token
github.com/streaak/keyhacks#ButterCMS-API-Key
github.com/streaak/keyhacks#Calendly-API-Key
github.com/streaak/keyhacks#CircleCI-Access-Token
github.com/streaak/keyhacks#Cypress-record-key
github.com/streaak/keyhacks#DataDog-API-key
github.com/streaak/keyhacks#Deviant-Art-Access-Token
github.com/streaak/keyhacks#Deviant-Art-Secret
github.com/streaak/keyhacks#Dropbox-API
github.com/streaak/keyhacks#Facebook-Access-Token
github.com/streaak/keyhacks#Facebook-AppSecret
github.com/streaak/keyhacks#Firebase
github.com/streaak/keyhacks#Firebase-Cloud-Messaging
github.com/streaak/keyhacks#FreshDesk-API-key
github.com/streaak/keyhacks#Github-client-id-and-client-secret
github.com/streaak/keyhacks#GitHub-private-SSH-key
github.com/streaak/keyhacks#Github-Token
github.com/streaak/keyhacks#Gitlab-personal-access-token
github.com/streaak/keyhacks#Google-Cloud-Service-Account-credentials
github.com/streaak/keyhacks#Google-Maps-API-key
github.com/streaak/keyhacks#Google-Recaptcha-key
github.com/streaak/keyhacks#Heroku-API-key
github.com/streaak/keyhacks#Hubspot-API-key
github.com/streaak/keyhacks#Instagram-Access-Token
github.com/streaak/keyhacks#Instagram-Basic-Display-API-Access-Token
github.com/streaak/keyhacks#Instagram-Graph-Api-Access-Token
github.com/streaak/keyhacks#Ipstack-API-Key
github.com/streaak/keyhacks#Iterable-API-Key
github.com/streaak/keyhacks#JumpCloud-API-Key
github.com/streaak/keyhacks#Keenio-API-Key
github.com/streaak/keyhacks#Lokalise-API-Key
github.com/streaak/keyhacks#Loqate-API-key
github.com/streaak/keyhacks#MailChimp-API-Key
github.com/streaak/keyhacks#MailGun-Private-Key
github.com/streaak/keyhacks#Mapbox-API-Key
github.com/streaak/keyhacks#Microsoft-Azure-Tenant
github.com/streaak/keyhacks#Microsoft-Shared-Access-Signatures-(SAS)
github.com/streaak/keyhacks#New-Relic-Personal-API-Key-(NerdGraph)
github.com/streaak/keyhacks#New-Relic-REST-API
github.com/streaak/keyhacks#NPM-token
github.com/streaak/keyhacks#Pagerduty-API-token
github.com/streaak/keyhacks#Paypal-client-id-and-secret-key
github.com/streaak/keyhacks#Pendo-Integration-Key
github.com/streaak/keyhacks#PivotalTracker-API-Token
github.com/streaak/keyhacks#Razorpay-keys
github.com/streaak/keyhacks#Salesforce-API-key
github.com/streaak/keyhacks#SauceLabs-Username-and-access-Key
github.com/streaak/keyhacks#SendGrid-API-Token
github.com/streaak/keyhacks#Slack-API-token
github.com/streaak/keyhacks#Slack-Webhook
github.com/streaak/keyhacks#Sonarcloud-Token
github.com/streaak/keyhacks#Spotify-Access-Token
github.com/streaak/keyhacks#Square
github.com/streaak/keyhacks#Stripe-Live-Token
github.com/streaak/keyhacks#Travis-CI-API-token
github.com/streaak/keyhacks#Twilio-Account_sid-and-Auth-token
github.com/streaak/keyhacks#Twitter-API-Secret
github.com/streaak/keyhacks#Twitter-Bearer-token
github.com/streaak/keyhacks#Visual-Studio-App-Center-API-Token
github.com/streaak/keyhacks#WakaTime-API-Key
github.com/streaak/keyhacks#weglot-api-key
github.com/streaak/keyhacks#WPEngine-API-Key
github.com/streaak/keyhacks#YouTube-API-Key
github.com/streaak/keyhacks#Zapier-Webhook-Token
github.com/streaak/keyhacks#Zendesk-Access-Token