Key Shape - check your API key design before a key leaks

Check a platform's API key design against what makes a leaked key survivable, then plan the day one leaks. Describe the keys and paste a few test keys - they never leave the page. Free in your browser: the prefix and its environment marker, entropy against the 120-bit floor, each test key's CRC32 checksum verified, scanner detectability, storage and scoping ranked from a short interview, rotation, the self-service dashboard, ownership and offboarding, governance and the OWASP API2 failure modes, plus a secret-scanner pattern and fresh test keys in the right shape. A metered run writes the key design, or the rotation and leak-response runbook. Built on the SkillSafe skill @samber/api-auth-key-management, from samber/developer-platform-skills (MIT), by Samuel Berthe.