Dhwaj is a fast, modular, and extensible API key verification framework inspired by KeyHacks — built to help security researchers, bug bounty hunters, developers, and DevSecOps teams validate leaked or discovered API keys safely and quickly.
It supports dozens of providers, automatic detection, structured testing, color-coded output, and a fully plugin-based architecture.
🚀 Features
- Validate API keys from 70+ popular services
- Modular provider system (
providers/<name>.py) - Central HTTP wrapper with warnings disabled
- Typed & MyPy-friendly codebase
- Extensible: add new providers with just ~10 lines
📦 Installation
pipx install dhwaj
🧩 Usage
List all available providers:
dhwaj
View help for a specific provider:
dhwaj github-token -h
Run a validation:
dhwaj github-token -t ghp_fake123
🏗 Provider System
Each provider lives in:
providers/<provider>.py
and follows the structure:
class ExampleChecker(Provider):
name = "example"
description = "Check Example API token"
args = [
("-k", "--key", "API Key for Example service"),
]
def run(self, args):
...
return True, "Valid Example key"
Providers automatically load through utils/loader.py.
🛠 Development
Install development deps:
pip install mypy ruff black
Type-check:
mypy .
Format:
black .
Lint:
ruff check .
🤝 Contributing
Contributions are welcome!
- Fork the repository
- Create a new branch
- Add or improve provider modules
- Run
mypy,ruff, andtestall.py - Submit a pull request
When submitting a new provider:
- Follow the
Providerclass structure - Provide a clear description
- Add meaningful arg names & help text
- Ensure type hints are complete
- Test with dummy inputs
🙏 Credits
This project stands on the shoulders of giants.
🔹 KeyHacks
Huge thanks to the original KeyHacks repository for inspiring many of the provider checks used here.
🔹 OpenAI
Special thanks to OpenAI’s ChatGPT for assisting in generating clean provider modules, documentation, and improving the tool’s architecture.
📜 License
MIT License — free to use, modify, and distribute.
⚡️ Why the name Dhwaj?
Dhwaj (ध्वज) means flag, banner, symbol of support or protection. This tool acts exactly like a protective flag — detecting weak/leaked API keys before attackers can exploit them.
⭐️ Show Your Support
If you find Dhwaj helpful:
- Star the repo ⭐
- Share with your security friends
- Contribute to make it bigger & better
Metadata
Release files for dhwaj 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| dhwaj-0.1.0.tar.gz | 21.0 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| dhwaj-0.1.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 70.2 kB
Release files / dhwaj-0.1.0.tar.gz
| Download URL | dhwaj-0.1.0.tar.gz |
|---|---|
| Size | 21.0 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
a8bccda196549178cd68bab3a4e58872598b4183c15e13777cf4f3e064b7cf07
|
|
BLAKE2b-256 checksum How to use checksums |
c7976cd5e633b6f6c93f100f25ad44264ea8a9f9338af73a695953fcbf1ef4a7
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.12.3
|
Release files / dhwaj-0.1.0-py3-none-any.whl
| Download URL | dhwaj-0.1.0-py3-none-any.whl |
|---|---|
| Size | 49.2 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
8f32193c2bc840f5a4f733949e5a8bfeff6c40b901992fa5d16417d280d71867
|
|
BLAKE2b-256 checksum How to use checksums |
f0aeb14c02cfb132cc46d319a8c721770ad2b635140ce1400990f444ae7ddf2c
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.12.3
|
Security for dhwaj 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.