What Carriel recognises

Every key Carriel names by itself, 164 kinds from 84 services and formats, and the shapes it knows without a service.

By category

Each service or format lists the names Carriel gives, what it recognises them by, and the env names it knows. The first env name is the one the card proposes; the others also tell it which service a pasted NAME=value belongs to.

Jump to: AI · Dev tools · Cloud & data · Payments · Accounts · Shapes Carriel knows without a service

AI

⌘1 · 21 kinds of key

Service or format	Carriel names it	Recognised by	Env names
Anthropic	Anthropic API key	`sk-ant-api03-` and 95 characters	`ANTHROPIC_API_KEY`, also `CLAUDE_API_KEY`
	Anthropic Admin key	`sk-ant-admin01-` and 95 characters	`ANTHROPIC_ADMIN_KEY`
	Claude Enterprise organization key	`sk-ant-api01-` and 60 to 140 base64url characters	`ANTHROPIC_ENTERPRISE_ADMIN_KEY`
AWS	Amazon Bedrock API key	`ABSK` and 109 to 271 characters	`AWS_BEARER_TOKEN_BEDROCK`
Cohere	Cohere API key	40 alphanumeric characters Only when a name pasted with it, or the page it was copied from, points to Cohere	`CO_API_KEY`, also `COHERE_API_KEY`
DeepSeek	DeepSeek API key	`sk-` and 32 hex characters Same shape as Qwen (DashScope) API key and Moonshot (Kimi) API key: the card asks which	`DEEPSEEK_API_KEY`
Google	Gemini API key	`AQ.Ab8RN6` and 44 base64url characters	`GEMINI_API_KEY`, also `GOOGLE_API_KEY`, `GOOGLE_GENERATIVE_AI_API_KEY`
Google	Gemini API key (AIza)	`AIza` and 35 base64url characters Same shape as Firebase API key and Google Maps API key: the card asks which	`GEMINI_API_KEY`, also `GOOGLE_API_KEY`, `GOOGLE_GENERATIVE_AI_API_KEY`
Groq	Groq API key	`gsk_` and 52 alphanumeric characters	`GROQ_API_KEY`
Hugging Face	Hugging Face access token	`hf_` and 34 characters	`HF_TOKEN`, also `HUGGINGFACE_API_KEY`, `HUGGING_FACE_HUB_TOKEN`
Mistral	Mistral API key	32 alphanumeric characters Only when a name pasted with it, or the page it was copied from, points to Mistral	`MISTRAL_API_KEY`
Moonshot	Moonshot (Kimi) API key	`sk-` and 32 hex characters Same shape as DeepSeek API key and Qwen (DashScope) API key: the card asks which	`MOONSHOT_API_KEY`, also `KIMI_API_KEY`
OpenAI	OpenAI project key	`sk-proj-` and 124 to 156 characters With a fixed marker every one carries	`OPENAI_API_KEY`, also `OPENAI_KEY`
	OpenAI service account key	`sk-svcacct-` and 124 to 156 characters With a fixed marker every one carries	`OPENAI_API_KEY`
	OpenAI admin key	`sk-admin-` and 124 to 156 characters With a fixed marker every one carries	`OPENAI_ADMIN_KEY`
	OpenAI key (older format)	`sk-` and 48 to 161 characters With a fixed marker every one carries	`OPENAI_API_KEY`
OpenRouter	OpenRouter API key	`sk-or-v1-` and 64 hex characters	`OPENROUTER_API_KEY`
Perplexity	Perplexity API key	`pplx-` and 48 alphanumeric characters	`PERPLEXITY_API_KEY`, also `PPLX_API_KEY`
Qwen	Qwen (DashScope) API key	`sk-` and 32 hex characters Same shape as DeepSeek API key and Moonshot (Kimi) API key: the card asks which	`DASHSCOPE_API_KEY`, also `QWEN_API_KEY`
Replicate	Replicate API token	`r8_` and 37 alphanumeric characters	`REPLICATE_API_TOKEN`
xAI	xAI API key	`xai-` and 80 alphanumeric characters	`XAI_API_KEY`

Dev tools

⌘2 · 72 kinds of key

Service or format	Carriel names it	Recognised by	Env names
age	age secret key	`AGE-SECRET-KEY-1` and 58 characters	`SOPS_AGE_KEY`, also `AGE_SECRET_KEY`
Algolia	Algolia admin API key	32 hex characters Only when a name pasted with it, or the page it was copied from, points to Algolia Same shape as Algolia search-only key (public): the card asks which	`ALGOLIA_ADMIN_KEY`, also `ALGOLIA_API_KEY`, `ALGOLIA_WRITE_API_KEY`
	Algolia search-only key (public)	32 hex characters Only when a name pasted with it points to Algolia Same shape as Algolia admin API key: the card asks which	`ALGOLIA_SEARCH_KEY`, also `ALGOLIA_SEARCH_API_KEY`
	Algolia application ID	10 characters Only when a name pasted with it points to Algolia	`ALGOLIA_APP_ID`
Apple	App Store Connect API key	A `.p8` file, usually `AuthKey_` and its 10-character key ID The card asks which: App Store Connect or Push notifications	`ASC_API_KEY`, also `APP_STORE_CONNECT_API_KEY`, `APP_STORE_CONNECT_API_KEY_KEY`
Apple	Apple Push Notification key	A `.p8` file, usually `AuthKey_` and its 10-character key ID The card asks which: App Store Connect or Push notifications	`APNS_KEY`, also `APNS_AUTH_KEY`
Atlassian	Atlassian API token	`ATATT3` and 186 characters Carriel checks its built-in checksum	`ATLASSIAN_API_TOKEN`, also `JIRA_API_TOKEN`, `CONFLUENCE_API_TOKEN`, `BITBUCKET_API_TOKEN`
Bitbucket	Bitbucket app password	`ATBB` and 28 to 60 characters	`BITBUCKET_APP_PASSWORD`
Brevo	Brevo API key	`xkeysib-` and 81 characters	`BREVO_API_KEY`, also `SENDINBLUE_API_KEY`
Clerk	Clerk webhook signing secret	`whsec_` and 24 to 100 base64 characters Same shape as Stripe webhook signing secret, Svix webhook signing secret and Resend webhook signing secret: the card asks which	`CLERK_WEBHOOK_SIGNING_SECRET`, also `CLERK_WEBHOOK_SECRET`
	Clerk live secret key Clerk test secret key	`sk_live_` or `sk_test_` and 40 to 60 alphanumeric characters Same shape as Stripe secret key: the card asks which	`CLERK_SECRET_KEY`
	Clerk live publishable key (public) Clerk test publishable key (public)	`pk_live_` or `pk_test_` and 16 to 202 characters Decodes to the app’s frontend address	`CLERK_PUBLISHABLE_KEY`
Contentful	Contentful management token	`CFPAT-` and 43 base64url characters	`CONTENTFUL_MANAGEMENT_TOKEN`
Databricks	Databricks access token	`dapi` and 32 to 34 characters	`DATABRICKS_TOKEN`
Datadog	Datadog API key	32 hex characters Only when a name pasted with it, or the page it was copied from, points to Datadog	`DD_API_KEY`, also `DATADOG_API_KEY`
Datadog	Datadog application key	40 hex characters Only when a name pasted with it, or the page it was copied from, points to Datadog	`DD_APP_KEY`, also `DATADOG_APP_KEY`, `DD_APPLICATION_KEY`
Discord	Discord bot token	58 to 76 characters Its first part decodes to the bot’s numeric ID	`DISCORD_BOT_TOKEN`, also `DISCORD_TOKEN`
Discord	Discord webhook URL	Starts with `https://discord.com/api/webhooks/` or `https://discordapp.com/api/webhooks/`, 111 to 137 characters in all	`DISCORD_WEBHOOK_URL`
Docker	Docker Hub access token	`dckr_` and 31 to 44 characters	`DOCKERHUB_TOKEN`, also `DOCKER_TOKEN`, `DOCKER_PASSWORD`
Doppler	Doppler token	`dp.` and 43 to 91 characters	`DOPPLER_TOKEN`
Figma	Figma personal access token	`figd_` and 40 to 60 base64url characters	`FIGMA_TOKEN`, also `FIGMA_ACCESS_TOKEN`, `FIGMA_API_KEY`
GitHub	GitHub token (classic)	`ghp_` and 36 alphanumeric characters Carriel checks its built-in checksum	`GITHUB_TOKEN`, also `GH_TOKEN`, `GITHUB_PAT`
	GitHub OAuth token	`gho_` and 36 alphanumeric characters Carriel checks its built-in checksum	`GITHUB_TOKEN`, also `GH_TOKEN`, `GITHUB_PAT`
	GitHub App user token	`ghu_` and 36 alphanumeric characters Carriel checks its built-in checksum	`GITHUB_TOKEN`, also `GH_TOKEN`, `GITHUB_PAT`
	GitHub App installation token	`ghs_` and 36 alphanumeric characters Carriel checks its built-in checksum	`GITHUB_TOKEN`, also `GH_TOKEN`, `GITHUB_PAT`
	GitHub refresh token	`ghr_` and 36 alphanumeric characters Carriel checks its built-in checksum	`GITHUB_TOKEN`, also `GH_TOKEN`, `GITHUB_PAT`
	GitHub App installation token	`ghs_` and 17 to 2,001 characters	`GITHUB_TOKEN`
	GitHub fine-grained token	`github_pat_` and 82 characters	`GITHUB_TOKEN`, also `GH_TOKEN`, `GITHUB_PAT`
GitLab	GitLab personal access token	`glpat-` and 20 to 310 characters	`GITLAB_TOKEN`, also `GITLAB_PAT`, `CI_JOB_TOKEN`
Grafana	Grafana service account token	`glsa_` and 41 characters	`GRAFANA_SERVICE_ACCOUNT_TOKEN`, also `GRAFANA_TOKEN`
HashiCorp	Terraform Cloud token	83 to 93 characters With a fixed marker every one carries	`TF_TOKEN_app_terraform_io`, also `TFE_TOKEN`, `TF_API_TOKEN`
HashiCorp	Vault token	`hvs.` and 90 to 120 base64url characters	`VAULT_TOKEN`
JWT	JSON Web Token	A JWT: three parts joined by dots, decoded on your Mac	`ACCESS_TOKEN`, also `JWT`, `API_TOKEN`
Kakao	Kakao REST API key	32 hex characters Only when a name pasted with it, or the page it was copied from, points to Kakao Same shape as Kakao Admin key and Kakao JavaScript key (public): the card asks which	`KAKAO_REST_API_KEY`
	Kakao Admin key	32 hex characters Only when a name pasted with it, or the page it was copied from, points to Kakao Same shape as Kakao REST API key and Kakao JavaScript key (public): the card asks which	`KAKAO_ADMIN_KEY`
	Kakao JavaScript key (public)	32 hex characters Only when a name pasted with it, or the page it was copied from, points to Kakao Same shape as Kakao REST API key and Kakao Admin key: the card asks which	`KAKAO_JAVASCRIPT_KEY`, also `KAKAO_JS_KEY`
Linear	Linear API key	`lin_api_` and 40 alphanumeric characters	`LINEAR_API_KEY`
Mailgun	Mailgun API key	50 characters	`MAILGUN_API_KEY`
Mailgun	Mailgun API key (older format)	`key-` and 32 hex characters	`MAILGUN_API_KEY`
Mapbox	Mapbox public token	`pk.eyJ` and 41 to 341 characters Its middle part decodes to the account’s JSON	`MAPBOX_ACCESS_TOKEN`, also `MAPBOX_TOKEN`
Mapbox	Mapbox secret token	`sk.eyJ` and 41 to 341 characters Its middle part decodes to the account’s JSON	`MAPBOX_SECRET_TOKEN`, also `MAPBOX_DOWNLOADS_TOKEN`
Naver	Naver client secret	10 characters Only when a name pasted with it, or the page it was copied from, points to Naver	`NAVER_CLIENT_SECRET`
Naver	Naver client ID	20 characters Only when a name pasted with it, or the page it was copied from, points to Naver	`NAVER_CLIENT_ID`
Notion	Notion integration token	`ntn_` and 46 characters	`NOTION_TOKEN`, also `NOTION_API_KEY`
Notion	Notion integration token (older format)	`secret_` and 43 alphanumeric characters	`NOTION_TOKEN`, also `NOTION_API_KEY`
npm	npm token	`npm_` and 36 alphanumeric characters Carriel checks its built-in checksum	`NPM_TOKEN`, also `NODE_AUTH_TOKEN`
OpenPGP	PGP private key	A PEM block labelled `PGP PRIVATE KEY BLOCK`	`GPG_PRIVATE_KEY`, also `PGP_PRIVATE_KEY`
OpenSSH	SSH private key	A PEM block labelled `OPENSSH PRIVATE KEY` The name adds the key type, and whether a passphrase protects it	`SSH_PRIVATE_KEY`, also `DEPLOY_KEY`
PEM	Private key (PEM)	A PEM block labelled `PRIVATE KEY`, `RSA PRIVATE KEY`, `EC PRIVATE KEY` or `DSA PRIVATE KEY` The name adds the algorithm, and whether a passphrase protects it	`PRIVATE_KEY`
PEM	Encrypted private key (PEM)	A PEM block labelled `ENCRYPTED PRIVATE KEY`	`PRIVATE_KEY`
PostHog	PostHog project key (public)	`phc_` and 43 alphanumeric characters	`POSTHOG_KEY`, also `POSTHOG_API_KEY`, `POSTHOG_PROJECT_API_KEY`
PostHog	PostHog personal API key	`phx_` and 43 to 47 alphanumeric characters	`POSTHOG_PERSONAL_API_KEY`
Postman	Postman API key	`PMAK-` and 59 characters	`POSTMAN_API_KEY`
Postmark	Postmark server token	The shape of a UUID: 32 hex characters in five groups Only when a name pasted with it, or the page it was copied from, points to Postmark	`POSTMARK_SERVER_TOKEN`, also `POSTMARK_API_TOKEN`
Pulumi	Pulumi access token	`pul-` and 40 hex characters	`PULUMI_ACCESS_TOKEN`
PyPI	PyPI API token	`pypi-AgEIcHlwaS5vcmc` and 50 to 1,000 base64url characters With a fixed marker every one carries	`PYPI_TOKEN`, also `PYPI_API_TOKEN`, `TWINE_PASSWORD`
PyPI	TestPyPI API token	`pypi-AgENdGVzdC5weXBpLm9yZw` and 50 to 1,000 base64url characters With a fixed marker every one carries	`TEST_PYPI_TOKEN`
Resend	Resend webhook signing secret	`whsec_` and 24 to 100 base64 characters Same shape as Stripe webhook signing secret, Svix webhook signing secret and Clerk webhook signing secret: the card asks which	`RESEND_WEBHOOK_SECRET`
Resend	Resend API key	`re_` and 27 to 45 characters	`RESEND_API_KEY`
SendGrid	SendGrid API key	`SG.` and 66 characters	`SENDGRID_API_KEY`
Sentry	Sentry DSN (public)	A DSN address on a host under `sentry.io`, with its public key and project number	`SENTRY_DSN`
	Sentry organization auth token	`sntrys_` and 67 to 447 characters Its middle part decodes to the organization’s address	`SENTRY_AUTH_TOKEN`
	Sentry user auth token	`sntryu_` and 64 hex characters	`SENTRY_AUTH_TOKEN`
Slack	Slack bot token	`xoxb-` and 46 to 52 characters	`SLACK_BOT_TOKEN`
	Slack user token	`xoxp-` and 65 to 74 characters	`SLACK_USER_TOKEN`
	Slack app-level token	`xapp-` and 87 to 93 characters	`SLACK_APP_TOKEN`
	Slack token (older format)	`xoxa-`, `xoxr-`, `xoxo-` or `xoxs-` and 10 to 200 characters	`SLACK_TOKEN`
	Slack incoming webhook URL	`https://hooks.slack.com/` and 29 to 170 characters	`SLACK_WEBHOOK_URL`
Telegram	Telegram bot token	41 to 52 characters	`TELEGRAM_BOT_TOKEN`, also `BOT_TOKEN`
Twilio	Twilio Account SID	`AC` and 32 hex characters	`TWILIO_ACCOUNT_SID`
	Twilio API key SID	`SK` and 32 hex characters	`TWILIO_API_KEY`, also `TWILIO_API_KEY_SID`
	Twilio auth token	32 hex characters Only when a name pasted with it, or the page it was copied from, points to Twilio	`TWILIO_AUTH_TOKEN`

Cloud & data

⌘3 · 51 kinds of key

Service or format	Carriel names it	Recognised by	Env names
1Password	1Password service account token	`ops_eyJ` and 250 to 1,003 characters Decodes to JSON	`OP_SERVICE_ACCOUNT_TOKEN`
AMQP	AMQP URL	A URL with a password in it, starting `amqp://` or `amqps://`, on a host under `cloudamqp.com`	`AMQP_URL`, also `RABBITMQ_URL`, `CLOUDAMQP_URL`
AWS	AWS access key ID	`AKIA`, `ABIA` or `ACCA` and 16 characters Decodes to an AWS account number	`AWS_ACCESS_KEY_ID`
	AWS temporary access key ID	`ASIA` and 16 characters Decodes to an AWS account number	`AWS_ACCESS_KEY_ID`
	AWS secret access key	40 base64 characters Only when a name pasted with it, or the page it was copied from, points to AWS	`AWS_SECRET_ACCESS_KEY`
	AWS session token	Starts with `IQoJb3JpZ2luX2Vj` or `FwoGZXIvYXdzE`, 113 to 1,016 characters in all	`AWS_SESSION_TOKEN`
	AWS access key (.csv download)	The `.csv` file the AWS console gives you for a new access key, with both halves of the pair	`AWS_ACCESS_KEY_ID`
Cloudflare	Cloudflare user API token	`cfut_` and 44 to 56 base64url characters	`CLOUDFLARE_API_TOKEN`, also `CF_API_TOKEN`
	Cloudflare account API token	`cfat_` and 44 to 56 base64url characters	`CLOUDFLARE_API_TOKEN`, also `CF_API_TOKEN`
	Cloudflare Global API key	`cfk_` and 44 to 56 base64url characters	`CLOUDFLARE_API_KEY`, also `CF_API_TOKEN`
	Cloudflare token (cfast_)	`cfast_` and 44 to 56 base64url characters	`CLOUDFLARE_API_TOKEN`, also `CF_API_TOKEN`
	Cloudflare API token (older format)	40 base64url characters Only when a name pasted with it, or the page it was copied from, points to Cloudflare	`CLOUDFLARE_API_TOKEN`, also `CF_API_TOKEN`
	Cloudflare Global API key (older format)	37 to 45 hex characters Only when a name pasted with it, or the page it was copied from, points to Cloudflare	`CLOUDFLARE_API_KEY`, also `CF_API_KEY`
DigitalOcean	DigitalOcean personal access token	`dop_v1_`, `doo_v1_` or `dor_v1_` and 64 hex characters	`DIGITALOCEAN_ACCESS_TOKEN`, also `DIGITALOCEAN_TOKEN`, `DO_TOKEN`
Fly.io	Fly.io access token	Starts with `fo1_`, `fm1r_`, `fm1a_` or `fm2_`, 47 to 1,008 characters in all	`FLY_API_TOKEN`, also `FLY_ACCESS_TOKEN`
Google	Firebase API key	`AIza` and 35 base64url characters Same shape as Google Maps API key and Gemini API key (AIza): the card asks which	`FIREBASE_API_KEY`
	Google Maps API key	`AIza` and 35 base64url characters Same shape as Firebase API key and Gemini API key (AIza): the card asks which	`GOOGLE_MAPS_API_KEY`
	Google OAuth client secret	`GOCSPX-` and 28 base64url characters	`GOOGLE_CLIENT_SECRET`, also `AUTH_GOOGLE_SECRET`
	Firebase legacy server key	`AAAA` and 148 characters With a fixed marker every one carries	`FCM_SERVER_KEY`
	Google service account key	A JSON key file whose `type` is `service_account`, with its private key and client email	`GOOGLE_SERVICE_ACCOUNT_KEY`, also `GOOGLE_APPLICATION_CREDENTIALS`, `FIREBASE_SERVICE_ACCOUNT`, `GCP_SA_KEY`, `GOOGLE_CREDENTIALS`
Heroku	Heroku API key	`HRKU-AA` and 58 base64url characters	`HEROKU_API_KEY`
Kubernetes	kubeconfig	A kubeconfig file: a `kind: Config` line and its `clusters:`	`KUBE_CONFIG`, also `KUBECONFIG_DATA`, `KUBECONFIG_B64`
MongoDB	MongoDB Atlas connection string	A URL with a password in it, starting `mongodb+srv://` or `mongodb://`, on a host under `mongodb.net`	`MONGODB_URI`, also `MONGO_URL`, `DATABASE_URL`
MongoDB	MongoDB connection string	A URL with a password in it, starting `mongodb://` or `mongodb+srv://`	`MONGODB_URI`, also `MONGO_URL`
MySQL	MySQL connection URL	A URL with a password in it, starting `mysql://` or `mariadb://`	`DATABASE_URL`
Neon	Neon API key	`napi_` and 60 to 72 alphanumeric characters	`NEON_API_KEY`
Neon	Neon database URL	A URL with a password in it, starting `postgres://` or `postgresql://`, on a host under `neon.tech`	`DATABASE_URL`
Netlify	Netlify personal access token	`nfp_` and 36 to 40 alphanumeric characters	`NETLIFY_AUTH_TOKEN`
Netlify	Netlify access token (older format)	40 to 46 base64url characters Only when a name pasted with it, or the page it was copied from, points to Netlify	`NETLIFY_AUTH_TOKEN`
PlanetScale	PlanetScale token	Starts with `pscale_tkn_`, `pscale_pw_` or `pscale_oauth_`, 42 to 77 characters in all	`PLANETSCALE_SERVICE_TOKEN`, also `DATABASE_PASSWORD`, `PLANETSCALE_PASSWORD`
PlanetScale	PlanetScale database URL	A URL with a password in it, starting `mysql://`, `postgres://` or `postgresql://`, on a host under `psdb.cloud` or `connect.psdb.cloud`	`DATABASE_URL`
PostgreSQL	Postgres connection URL	A URL with a password in it, starting `postgres://` or `postgresql://`	`DATABASE_URL`
Railway	Railway token	The shape of a UUID: 32 hex characters in five groups Only when a name pasted with it, or the page it was copied from, points to Railway	`RAILWAY_TOKEN`, also `RAILWAY_API_TOKEN`
Railway	Railway database URL	A URL with a password in it, starting `postgres://`, `postgresql://`, `mysql://`, `redis://` or `mongodb://`, on a host under `rlwy.net`, `railway.app` or `railway.internal`	`DATABASE_URL`
Redis	Redis URL	A URL with a password in it, starting `redis://` or `rediss://`	`REDIS_URL`
Supabase	Supabase secret key	`sb_secret_` and 20 to 64 base64url characters	`SUPABASE_SECRET_KEY`
	Supabase publishable key (public)	`sb_publishable_` and 20 to 64 base64url characters	`SUPABASE_PUBLISHABLE_KEY`
	Supabase anon key (public)	A JWT issued by Supabase with the role `anon`, decoded on your Mac	`SUPABASE_ANON_KEY`
	Supabase service role key	A JWT issued by Supabase with the role `service_role`, decoded on your Mac	`SUPABASE_SERVICE_ROLE_KEY`
	Supabase access token	`sbp_` and 40 hex characters	`SUPABASE_ACCESS_TOKEN`
	Supabase database URL	A URL with a password in it, starting `postgres://` or `postgresql://`, on a host under `supabase.co` or `supabase.com`	`DATABASE_URL`
Tailscale	Tailscale auth key	`tskey-auth-` and 29 to 73 characters	`TS_AUTHKEY`, also `TAILSCALE_AUTHKEY`
	Tailscale API access token	`tskey-api-` and 29 to 73 characters	`TAILSCALE_API_KEY`, also `TS_API_KEY`
	Tailscale OAuth client secret	`tskey-client-` and 29 to 73 characters	`TS_OAUTH_CLIENT_SECRET`
Upstash	Upstash QStash token	`eyJVc2VySUQiOi` and 30 to 400 characters Decodes to JSON	`QSTASH_TOKEN`
	Upstash Redis REST token	51 to 102 characters Only when a name pasted with it, or the page it was copied from, points to Upstash	`UPSTASH_REDIS_REST_TOKEN`, also `KV_REST_API_TOKEN`
	Upstash Redis URL	A URL with a password in it, starting `rediss://` or `redis://`, on a host under `upstash.io`	`REDIS_URL`, also `UPSTASH_REDIS_URL`, `KV_URL`
URL	Database connection URL	A URL with a password in it, starting `mssql://`, `sqlserver://` or `clickhouse://`	`DATABASE_URL`
URL	Link with a password in it	A link with a user name and password in it, starting `https://`, `http://`, `ftp://`, `sftp://`, `smtp://` or `smtps://`	`SERVICE_URL`, also `DATABASE_URL`
Vercel	Vercel access token	24 alphanumeric characters Only when a name pasted with it, or the page it was copied from, points to Vercel	`VERCEL_TOKEN`
Vercel	Vercel Blob read-write token	`vercel_blob_rw_` and 47 characters	`BLOB_READ_WRITE_TOKEN`

Payments

⌘4 · 19 kinds of key

Service or format	Carriel names it	Recognised by	Env names
Lemon Squeezy	Lemon Squeezy API key	A JWT: three parts joined by dots, decoded on your Mac Only when a name pasted with it, or the page it was copied from, points to Lemon Squeezy Same shape as JSON Web Token: the card asks which	`LEMONSQUEEZY_API_KEY`
Paddle	Paddle live API key Paddle sandbox API key	`pdl_live_apikey_` or `pdl_sdbx_apikey_` and 47 to 67 characters	`PADDLE_API_KEY`
PayPal	Braintree access token	`access_token$` and 57 to 60 characters	`BRAINTREE_ACCESS_TOKEN`
	PayPal client secret	80 characters Only when a name pasted with it, or the page it was copied from, points to PayPal	`PAYPAL_CLIENT_SECRET`
	PayPal client ID	80 characters Only when a name pasted with it, or the page it was copied from, points to PayPal	`PAYPAL_CLIENT_ID`
Paystack	Paystack live secret key Paystack test secret key	`sk_live_` or `sk_test_` and 40 hex characters	`PAYSTACK_SECRET_KEY`
Paystack	Paystack live public key Paystack test public key	`pk_live_` or `pk_test_` and 40 hex characters	`PAYSTACK_PUBLIC_KEY`
Shopify	Shopify Admin API access token	`shpat_`, `shpca_` or `shppa_` and 32 hex characters	`SHOPIFY_ADMIN_ACCESS_TOKEN`, also `SHOPIFY_ACCESS_TOKEN`
Shopify	Shopify app shared secret	`shpss_` and 32 hex characters	`SHOPIFY_API_SECRET`
Square	Square access token	Starts with `EAAA` or `sq0atp-`, 29 to 64 characters in all	`SQUARE_ACCESS_TOKEN`
Square	Square application secret	`sq0csp-` and 43 base64url characters	`SQUARE_APPLICATION_SECRET`
Stripe	Stripe live secret key Stripe test secret key	`sk_live_` or `sk_test_` and 10 to 247 alphanumeric characters Same shape as Clerk secret key: the card asks which	`STRIPE_SECRET_KEY`, also `STRIPE_API_KEY`, `STRIPE_KEY`
	Stripe live restricted key Stripe test restricted key	`rk_live_` or `rk_test_` and 10 to 247 alphanumeric characters	`STRIPE_RESTRICTED_KEY`, also `STRIPE_SECRET_KEY`
	Stripe organization key	`sk_org_` and 20 to 247 characters	`STRIPE_ORG_SECRET_KEY`
	Stripe live publishable key (public) Stripe test publishable key (public)	`pk_live_` or `pk_test_` and 10 to 247 alphanumeric characters	`STRIPE_PUBLISHABLE_KEY`, also `STRIPE_PUBLIC_KEY`
	Stripe webhook signing secret	`whsec_` and 24 to 100 base64 characters Same shape as Svix webhook signing secret, Clerk webhook signing secret and Resend webhook signing secret: the card asks which	`STRIPE_WEBHOOK_SECRET`, also `STRIPE_SIGNING_SECRET`
Svix	Svix webhook signing secret	`whsec_` and 24 to 100 base64 characters Same shape as Stripe webhook signing secret, Clerk webhook signing secret and Resend webhook signing secret: the card asks which	`SVIX_WEBHOOK_SECRET`, also `WEBHOOK_SECRET`
Toss Payments	Toss Payments live secret key Toss Payments test secret key	Starts with `live_gsk_`, `test_gsk_`, `live_sk_` or `test_sk_`, 24 to 69 characters in all	`TOSS_SECRET_KEY`, also `TOSS_PAYMENTS_SECRET_KEY`
Toss Payments	Toss Payments live client key (public) Toss Payments test client key (public)	Starts with `live_gck_`, `test_gck_`, `live_ck_` or `test_ck_`, 24 to 69 characters in all	`TOSS_CLIENT_KEY`

Accounts

⌘5 · 1 kind of key

Service or format	Carriel names it	Recognised by	Env names
1Password	1Password Secret Key	`A3-` and 36 to 37 characters	`OP_SECRET_KEY`

Shapes Carriel knows without a service

These come from the shape of what you paste, type or drop, never from a service’s rules.

Carriel names it	Kind	Recognised by	Category
Wi-Fi password	Password	A Wi-Fi QR string, `WIFI:S:…;P:…;;`. The network becomes where it’s used.	Home
Recovery codes	Recovery codes	4 to 24 one-time codes of the same shape, one or two to a line, numbered or not, with up to three other lines such as a heading. A file name or page that names a service adds it to the name, such as “GitHub recovery codes”.	Accounts
Apple Account recovery key	Key	28 capital letters and digits in seven groups of four. Carriel takes it only once you’ve added a pouch password.	Accounts
App-specific password	Password	Apple’s shape: four groups of four lower-case letters, joined by hyphens.	Accounts
Two-factor setup key	Key	An `otpauth://` link from a two-factor QR code. Carriel keeps it and makes no codes.	Accounts
License key	Key	Four to six groups of four to six capital letters and digits, joined by hyphens, with at least one letter and one digit. A Carriel license is different: the card offers Use License and never keeps it as a thing.	Other
Password	Password	Two or three lines such as `username: …` and `password: …`, with an optional `site: …`, labelled in English or Korean: the account and the site go in their own fields. Also a value named `password`, `pin` or `passcode`, and anything else you type into the card yourself. Home when the words say Wi-Fi, router, door, garage, gate or alarm.	Accounts or Home
A 6-digit code	Password	A number of 4 to 8 digits, such as a PIN or a door code. The number in the name is its length.	Accounts or Home
A 32-character key	Key	Anything key-like that no rule knows. The number in the name is its length, and the title stays empty for you. A name pasted with it becomes the title and can choose the category: `OPENAI_ORG_ID` becomes “OpenAI org ID”, in AI.	Other
Public key	Key	An SSH public key line, an age public key, or a PEM block labelled `PUBLIC KEY`.	Dev tools
Certificate	Key	A PEM block labelled `CERTIFICATE`.	Dev tools
Note	Note	Text that isn’t a key: a sentence, a link, an email address, a path, a model name, a UUID, a hash, a database URL without a password, several lines no rule knows, or a key or password over 64 KB.	Other

Blocks of names and values

A paste of several lines splits into one thing per secret, each named as above, or stays whole as one note whose names stay visible and whose values don’t. With 2 to 10 lines and at least one key Carriel recognises, the card proposes the split; otherwise it proposes the note. Settings that aren’t secrets, like PORT, come unticked as “Not a secret”.

Carriel names it	Format
.env block	Lines of `NAME=value`, with or without `export`.
YAML block	`NAME: value` lines, such as a compose file’s environment.
JSON block	A JSON object of names and values, such as an MCP server’s configuration.
docker -e flags	`docker run -e NAME=value` flags.
fish set -x lines	`set -x NAME value` lines.
PowerShell $env: lines	`$env:NAME = "value"` lines.
credentials file	An INI-style file of `name = value` lines under `[sections]`, such as AWS’s `credentials` file.

A single NAME=value or name: value line keeps its name only when a person plainly wrote one: CAPS_WITH_UNDERSCORES, one secret word such as password or token, or words joined by _, - or . with a secret word among them, such as db_password. That name becomes the env name, and the title when no rule names the value. Anything else, such as a password with = in it, stays one value.

Files

A dropped file is named by its type, and its title is its file name without the extension. A file with no extension is recognised by its first bytes (PDF, PNG, JPEG, GIF, TIFF, HEIC, ZIP). A text file of 64 KB or less is also read as text, so a key, recovery codes or an .env block inside become what they are.

Carriel names it	Files	Category
App Store Connect API key Apple Push Notification key	`.p8` The card asks which: App Store Connect or Push notifications.	Dev tools
Certificate bundle (.p12)	`.p12`, `.pfx` The card has a field for its password, which you may leave empty.	Dev tools
Provisioning profile	`.mobileprovision`, `.provisionprofile`	Dev tools
VPN configuration	`.ovpn`, `.mobileconfig`	Dev tools
Certificate	`.cer`, `.crt`, `.der`	Dev tools
.env block	`.env`, `.env.local`, `prod.env` Any `.env` file: it splits as a pasted block does.	Dev tools
PDF document	`.pdf`	Documents
PNG image, JPEG image and so on	`.png`, `.jpg`, `.jpeg`, `.heic`, `.heif`, `.gif`, `.tif`, `.tiff`, `.webp`, `.bmp`	Documents
Archive	`.zip`, `.gz`, `.tgz`, `.7z`, `.rar`, `.dmg`	Documents
Text file	`.txt`, `.md`, `.rtf`	Documents
JSON file, CSV file and so on	Any other file, by its extension.	Documents

What Carriel tidies in a paste

Before it looks, Carriel takes off quotes around a value, a Bearer or Token in front of it and an export before a name, drops a byte-order mark and zero-width characters at the edges, and turns Windows line endings into plain ones. It changes the inside of a value only when the result then matches a rule exactly, such as a key a terminal wrapped onto two lines.

Something missing?

If a key you keep isn’t here, Carriel still takes it: it leaves the name for you and puts it in Other. Write to Support with the service’s name and where its keys are made, never a key itself.