Regex for Generic API key
Common API key shape — 20-64 alphanumerics with dashes/underscores.
The Generic API key regex is ^[A-Za-z0-9_\-]{20,64}$ — copy it below, or open it in the explainer for a token-by-token breakdown.
The pattern
^[A-Za-z0-9_\-]{20,64}$
Token-by-token breakdown
Every part of the pattern, left to right:
| Token | Meaning |
|---|---|
^ | start of string (or line in multiline mode) |
[A-Za-z0-9_\-]{20,64} | between 20 and 64 times: any of: uppercase letters, lowercase letters, digits, “_”, “-” |
$ | end of string (or line in multiline mode) |
About this pattern
Identifier formats like UUIDs, hashes, and version strings have well-defined structures that regex captures cleanly. The pattern verifies format; checksums and validity against a registry need additional checks.
Quick usage in different languages
This exact pattern — with the correct escaping and idioms for each language:
- JavaScript:
/^[A-Za-z0-9_\-]{20,64}$/.test(value) - Python:
re.match(r"^[A-Za-z0-9_\-]{20,64}$", value) - Java:
Pattern.compile("^[A-Za-z0-9_\\-]{20,64}$").matcher(value).matches() - C# / .NET:
Regex.IsMatch(value, @"^[A-Za-z0-9_\-]{20,64}$") - Go:
regexp.MustCompile(`^[A-Za-z0-9_\-]{20,64}$`).MatchString(value) - Ruby:
/^[A-Za-z0-9_\-]{20,64}$/.match?(value) - PHP:
preg_match('~^[A-Za-z0-9_\-]{20,64}$~', $value)
The explainer’s Code tab regenerates these for any pattern you paste, and the downloadable cheat sheet bundles the breakdown, all seven snippets, and the pitfalls below onto one printable page.
Common pitfalls
- Anchored to the whole string. This pattern uses ^ and $, so it requires the entire input to match. To find it inside a longer text, drop the anchors and use the global (g) flag.
- ASCII letters only. [a-zA-Z] excludes accented and non-Latin letters (é, ü, ß, ñ, and non-Latin scripts). For international input use Unicode properties like \p{L} with the u flag.
- Escape it correctly per language. In Java and JavaScript strings each backslash must be doubled (\\d); in Python, Go, and C# use raw/verbatim strings so the backslashes survive.
- Validate beyond format. Matching the format doesn't guarantee the value is real. Confirm the generic api key against a source of truth (database, API, or checksum) where it matters.
Related patterns
More patterns in the Codes & IDs category:
- SSH public key
- Semver range (npm style)
- PEM-encoded key/certificate
- CUSIP (security ID)
- UUID / GUID
- Solana address
See also
Browse all 300 patterns in the library, or open this regex in the interactive explainer to see a token-by-token breakdown, test against custom input, and generate code in seven languages.