bubbleio.wtf

Top leaked Bubble API keys

The API key providers most often found exposed in public Bubble app bundles scanned by Bubbleio WTF.

Top exposed key patterns

Provider counts come from public Bubble bundle scans. They are scan-hit signals, not proof that every app is vulnerable, but they show which integration boundaries most often leak into the browser.

  1. 1. SlackWebhook 400
  2. 2. OpenAI 174
  3. 3. GCPApplicationDefaultCredentials 61
  4. 4. Box 56
  5. 5. Slack 47
  6. 6. Apify 44
  7. 7. GoogleGeminiAPIKey 44
  8. 8. Stripe 30
  9. 9. JWT 27
  10. 10. Atera 26
  11. 11. HubSpotApiKey 26
  12. 12. SalesforceOauth2 24
  13. 13. Shopify 21
  14. 14. DiscordWebhook 20
  15. 15. SendGrid 19
  16. 16. Twilio 17
  17. 17. Privacy 16
  18. 18. IPInfo 15
  19. 19. Anthropic 12
  20. 20. Pipedrive 12
  21. 21. Chatbot 11
  22. 22. Pagarme 11
  23. 23. Klaviyo 10
  24. 24. GCP 10
  25. 25. Azure 9
  26. 26. SquareApp 8
  27. 27. ElevenLabs 7
  28. 28. AzureAPIManagementSubscriptionKey 7
  29. 29. LinkPreview 7
  30. 30. SalesforceRefreshToken 6
  31. 31. IPQuality 6
  32. 32. AlgoliaAdminKey 6
  33. 33. Groq 6
  34. 34. Auth0ManagementApiToken 6
  35. 35. Apiflash 6
  36. 36. Postmark 6
  37. 37. ScraperAPI 6
  38. 38. AWS 6
  39. 39. ScrapingBee 6
  40. 40. Pixabay 5
  41. 41. Paystack 5
  42. 42. Replicate 5
  43. 43. IpStack 5
  44. 44. Notion 5
  45. 45. ShopifyOAuth 4
  46. 46. AzureRefreshToken 4
  47. 47. Pinecone 4
  48. 48. ExchangeRatesAPI 4
  49. 49. URI 4
  50. 50. Alchemy 3
  51. 51. Polygon 3
  52. 52. GetGeoAPI 3
  53. 53. Jotform 3
  54. 54. JiraToken 3
  55. 55. TicketMaster 3
  56. 56. Diffbot 3
  57. 57. IPGeolocation 3
  58. 58. HuggingFace 3
  59. 59. TwitterConsumerkey 3
  60. 60. BoxOauth 3
  61. 61. Deepgram 3
  62. 62. ClickupPersonalToken 2
  63. 63. FlightLabs 2
  64. 64. Github 2
  65. 65. AzureSearchAdminKey 2
  66. 66. ScreenshotAPI 2
  67. 67. ZipCodeAPI 2
  68. 68. Html2Pdf 2
  69. 69. Postgres 2
  70. 70. Unsplash 2
  71. 71. OpenWeather 2
  72. 72. Vpnapi 2
  73. 73. Etherscan 2
  74. 74. TelegramBotToken 2
  75. 75. PdfLayer 2
  76. 76. Mailchimp 2
  77. 77. Ipapi 2
  78. 78. TrelloApiKey 2
  79. 79. BingSubscriptionKey 2
  80. 80. XAI 2
  81. 81. Currencyfreaks 2
  82. 82. DuffelToken 2
  83. 83. Marketstack 1
  84. 84. ScrapingAnt 1
  85. 85. YoutubeApiKey 1
  86. 86. OpenRouter 1
  87. 87. AzureOpenAI 1
  88. 88. SendinBlueV2 1
  89. 89. ScreenshotLayer 1
  90. 90. Pipedream 1
  91. 91. PusherChannelKey 1
  92. 92. Lemlist 1
  93. 93. Zenserp 1
  94. 94. Kickbox 1
  95. 95. Ethplorer 1
  96. 96. Blogger 1
  97. 97. Meraki 1
  98. 98. MongoDB 1
  99. 99. Eventbrite 1
  100. 100. Spoonacular 1
  101. 101. Parsehub 1
  102. 102. DeepSeek 1
  103. 103. AviationStack 1
  104. 104. Yelp 1
  105. 105. Calendarific 1
  106. 106. MediaStack 1
  107. 107. SelectPDF 1
  108. 108. AutoPilot 1

Based on more than 14608 public bundle scans.