bubbleio.wtf

Top leaked Bubble API keys

The API key providers most often found exposed in public Bubble app bundles scanned by Bubbleio WTF.

Top exposed key patterns

Provider counts come from public Bubble bundle scans. They are scan-hit signals, not proof that every app is vulnerable, but they show which integration boundaries most often leak into the browser.

  1. 1. SlackWebhook 579
  2. 2. Postmark 173
  3. 3. GCPApplicationDefaultCredentials 78
  4. 4. OpenAI 63
  5. 5. HubSpotApiKey 57
  6. 6. Apify 51
  7. 7. Slack 49
  8. 8. Box 46
  9. 9. Atera 31
  10. 10. Stripe 31
  11. 11. JWT 30
  12. 12. SalesforceOauth2 26
  13. 13. DiscordWebhook 26
  14. 14. Shopify 25
  15. 15. Twilio 19
  16. 16. SendGrid 19
  17. 17. Chatbot 19
  18. 18. Privacy 19
  19. 19. GoogleGeminiAPIKey 18
  20. 20. Azure 17
  21. 21. IPInfo 16
  22. 22. Pipedrive 13
  23. 23. MicrosoftTeamsWebhook 12
  24. 24. Anthropic 11
  25. 25. Klaviyo 9
  26. 26. SquareApp 9
  27. 27. GCP 9
  28. 28. AWS 8
  29. 29. Auth0ManagementApiToken 8
  30. 30. LinkPreview 8
  31. 31. ElevenLabs 7
  32. 32. Apiflash 7
  33. 33. Paystack 7
  34. 34. Pagarme 7
  35. 35. AlgoliaAdminKey 7
  36. 36. AzureAPIManagementSubscriptionKey 6
  37. 37. Groq 6
  38. 38. ScraperAPI 6
  39. 39. Replicate 6
  40. 40. IPQuality 6
  41. 41. Pixabay 5
  42. 42. SalesforceRefreshToken 5
  43. 43. Notion 5
  44. 44. TwitterConsumerkey 5
  45. 45. ScrapingBee 5
  46. 46. URI 4
  47. 47. AzureRefreshToken 4
  48. 48. IpStack 4
  49. 49. Pinecone 4
  50. 50. ExchangeRatesAPI 4
  51. 51. AzureSasToken 4
  52. 52. BoxOauth 4
  53. 53. ShopifyOAuth 4
  54. 54. Alchemy 3
  55. 55. Deepgram 3
  56. 56. IPGeolocation 3
  57. 57. Diffbot 3
  58. 58. Jotform 3
  59. 59. ClickupPersonalToken 3
  60. 60. Unsplash 3
  61. 61. GetGeoAPI 3
  62. 62. TicketMaster 3
  63. 63. HuggingFace 3
  64. 64. OpenRouter 2
  65. 65. AzureSearchAdminKey 2
  66. 66. Lob 2
  67. 67. Ipapi 2
  68. 68. JiraToken 2
  69. 69. ScreenshotAPI 2
  70. 70. AzureOpenAI 2
  71. 71. CloudflareApiToken 2
  72. 72. TelegramBotToken 2
  73. 73. ZipCodeAPI 2
  74. 74. Html2Pdf 2
  75. 75. Currencyfreaks 2
  76. 76. Vpnapi 2
  77. 77. TrelloApiKey 2
  78. 78. Mailchimp 2
  79. 79. Postgres 2
  80. 80. Etherscan 2
  81. 81. Polygon 2
  82. 82. XAI 2
  83. 83. OpenWeather 2
  84. 84. Meraki 1
  85. 85. ScreenshotLayer 1
  86. 86. FlightLabs 1
  87. 87. PusherChannelKey 1
  88. 88. AviationStack 1
  89. 89. TwelveData 1
  90. 90. SendinBlueV2 1
  91. 91. Calendarific 1
  92. 92. Spoonacular 1
  93. 93. ScrapeStack 1
  94. 94. DuffelToken 1
  95. 95. Parsehub 1
  96. 96. Resend 1
  97. 97. Pipedream 1
  98. 98. DeepSeek 1
  99. 99. Github 1
  100. 100. Eventbrite 1
  101. 101. PdfLayer 1
  102. 102. PosthogApp 1
  103. 103. ScrapingAnt 1
  104. 104. MediaStack 1
  105. 105. MongoDB 1
  106. 106. Yelp 1
  107. 107. AutoPilot 1
  108. 108. PlaidKey 1
  109. 109. LocationIQ 1
  110. 110. YoutubeApiKey 1
  111. 111. Marketstack 1
  112. 112. Zerobounce 1
  113. 113. Lemlist 1
  114. 114. Zenserp 1
  115. 115. SerpStack 1
  116. 116. RazorPay 1
  117. 117. Kickbox 1
  118. 118. Ethplorer 1
  119. 119. Blogger 1

Based on more than 14611 public bundle scans.