---
id: "heroku_oauth_token"
kind: "datatype"
status: "draft"
is_pii: false
categories: ["secrets"]
langs: ["common"]
quality: 78
url: "http://registry.apicrafter.io/datatype/heroku_oauth_token"
---

# Heroku API OAuth access token (`heroku_oauth_token`)

> **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions.

OAuth access token of the Heroku Platform API, which the Heroku CLI also uses. Tokens granted from April 2024 start with HRKU-: until April 2025 the prefix was followed by a UUID (41 characters in all), and newer tokens have 65 characters. Older tokens are a bare UUID and cannot be told from other UUIDs, so the regexp covers only the prefixed forms.

- Parent datatype: `access_token`
- Personal data (PII): no
- Categories: Secrets and credentials (passwords, keys, tokens) (secrets)
- Countries: global
- Languages: Common to most languages (common)
- Classification: identifier

## Detection

Regular expression (Python `re`):

```
^HRKU-(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|AA[0-9A-Za-z_-]{58})$
```

## Examples

- `HRKU-AAExampleTokenExampleTokenExampleTokenExampleTokenExampleTok` — Constructed, non-functional value in the 65-character form
- `57dce771-afad-4c41-a8a5-d10b7fbc743c` (invalid example) — Token in the old format without the prefix

## Supported by tools

- `gitleaks`
- `semgrep`
- `trufflehog`

## Sources

- doc: <https://devcenter.heroku.com/changelog-items/2842>
- doc: <https://devcenter.heroku.com/changelog-items/3176>
- other: <https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml>

## Quality

Score 78/100. Missing: second example, mapping (Wikidata, Schema.org, ...), translation.

JSON: <http://registry.apicrafter.io/api/v1/datatypes/heroku_oauth_token.json> · Edit: <https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/secrets/heroku_oauth_token.yaml>