bubbleio.wtf

Top leaked Bubble API keys

The API key providers most often found exposed in public Bubble app bundles scanned by Bubbleio WTF.

Top exposed key patterns

Provider counts come from public Bubble bundle scans. They are scan-hit signals, not proof that every app is vulnerable, but they show which integration boundaries most often leak into the browser.

  1. 1. SlackWebhook 593
  2. 2. Postmark 173
  3. 3. OpenAI 84
  4. 4. GCPApplicationDefaultCredentials 79
  5. 5. HubSpotApiKey 58
  6. 6. Apify 52
  7. 7. Box 49
  8. 8. Slack 49
  9. 9. Stripe 31
  10. 10. Atera 31
  11. 11. JWT 29
  12. 12. Shopify 27
  13. 13. SalesforceOauth2 26
  14. 14. DiscordWebhook 26
  15. 15. GoogleGeminiAPIKey 24
  16. 16. Twilio 19
  17. 17. SendGrid 19
  18. 18. Privacy 19
  19. 19. Chatbot 17
  20. 20. Azure 17
  21. 21. IPInfo 16
  22. 22. Pipedrive 13
  23. 23. Anthropic 11
  24. 24. MicrosoftTeamsWebhook 11
  25. 25. Klaviyo 9
  26. 26. SquareApp 9
  27. 27. Pagarme 9
  28. 28. GCP 9
  29. 29. Auth0ManagementApiToken 8
  30. 30. LinkPreview 8
  31. 31. AWS 8
  32. 32. Paystack 7
  33. 33. AlgoliaAdminKey 7
  34. 34. Apiflash 7
  35. 35. ElevenLabs 7
  36. 36. Lob 7
  37. 37. AzureAPIManagementSubscriptionKey 6
  38. 38. IPQuality 6
  39. 39. ScraperAPI 6
  40. 40. Groq 6
  41. 41. SalesforceRefreshToken 5
  42. 42. Notion 5
  43. 43. Pixabay 5
  44. 44. ScrapingBee 5
  45. 45. Replicate 5
  46. 46. TwitterConsumerkey 5
  47. 47. ShopifyOAuth 4
  48. 48. BoxOauth 4
  49. 49. AzureRefreshToken 4
  50. 50. Pinecone 4
  51. 51. ExchangeRatesAPI 4
  52. 52. IpStack 4
  53. 53. URI 4
  54. 54. AzureSasToken 4
  55. 55. Deepgram 3
  56. 56. TicketMaster 3
  57. 57. GetGeoAPI 3
  58. 58. Alchemy 3
  59. 59. HuggingFace 3
  60. 60. Unsplash 3
  61. 61. IPGeolocation 3
  62. 62. ClickupPersonalToken 3
  63. 63. Jotform 3
  64. 64. Diffbot 3
  65. 65. Html2Pdf 2
  66. 66. TrelloApiKey 2
  67. 67. CloudflareApiToken 2
  68. 68. FlightLabs 2
  69. 69. OpenRouter 2
  70. 70. AzureSearchAdminKey 2
  71. 71. JiraToken 2
  72. 72. ZipCodeAPI 2
  73. 73. XAI 2
  74. 74. Postgres 2
  75. 75. Currencyfreaks 2
  76. 76. Ipapi 2
  77. 77. Vpnapi 2
  78. 78. Mailchimp 2
  79. 79. ScreenshotAPI 2
  80. 80. OpenWeather 2
  81. 81. Etherscan 2
  82. 82. TelegramBotToken 2
  83. 83. Polygon 2
  84. 84. DuffelToken 1
  85. 85. LocationIQ 1
  86. 86. MediaStack 1
  87. 87. PlaidKey 1
  88. 88. YoutubeApiKey 1
  89. 89. Marketstack 1
  90. 90. Zerobounce 1
  91. 91. AutoPilot 1
  92. 92. ScrapingAnt 1
  93. 93. Github 1
  94. 94. AzureOpenAI 1
  95. 95. ScrapeStack 1
  96. 96. Pipedream 1
  97. 97. SendinBlueV2 1
  98. 98. TwelveData 1
  99. 99. ScreenshotLayer 1
  100. 100. RazorPay 1
  101. 101. PusherChannelKey 1
  102. 102. Lemlist 1
  103. 103. Zenserp 1
  104. 104. MongoDB 1
  105. 105. Kickbox 1
  106. 106. Ethplorer 1
  107. 107. Blogger 1
  108. 108. Meraki 1
  109. 109. Eventbrite 1
  110. 110. Spoonacular 1
  111. 111. SerpStack 1
  112. 112. Parsehub 1
  113. 113. DeepSeek 1
  114. 114. PdfLayer 1
  115. 115. PosthogApp 1
  116. 116. AviationStack 1
  117. 117. Calendarific 1
  118. 118. Yelp 1

Based on more than 14611 public bundle scans.