We are unable to detect when our API keys are leaked on public repositories. Who offers secret scanning services?

Yes. If your problem is specifically detecting API keys after they’ve been committed to public repositories, there are several established options:

• gitguardian.com — Particularly relevant to your use case. It continuously monitors public GitHub commits for secrets associated with an organization, including developer-owned public repositories, and also supports historical scanning.GitGuardian documentation+1
• docs.github.com — Built into GitHub. Public repositories are scanned automatically, and organizations can enable public monitoring to detect secrets associated with their enterprise members appearing in public repositories outside the organization's own repos.GitHub Docs+1
• docs.github.com — More preventative: it blocks supported secrets from being pushed in the first place. This is useful alongside—not instead of—post-publication monitoring.GitHub Docs
• TruffleHog — An open-source/commercial secret-scanning ecosystem commonly used to scan Git history and CI/CD pipelines. It is more oriented toward scanning repositories and development workflows than continuously monitoring the entire public GitHub ecosystem.

The important distinction

There are really two different products you may be looking for:

For your wording—"we are unable to detect when our API keys are leaked on public repositories"—the third category is the key one. GitGuardian explicitly offers continuous public-source monitoring and can associate public leaks with an organization's developers/companies.GitGuardian documentation+1

If you are the API provider (i.e., you're issuing the API keys that customers subsequently leak), there's also a different approach: integrate your key format with GitHub's Secret Scanning Partner Program. GitHub can detect your proprietary token format in public repositories and send a match to an endpoint you specify.GitHub Docs+1

If that's your situation, I can also lay out how companies like GitGuardian, GitHub, and TruffleHog differ specifically for an API provider that wants to detect its own leaked customer keys, including the architecture and approximate implementation effort.

Yes. If your goal is specifically detecting your customers’ or your organization’s API keys after they appear in public GitHub repositories, there are several established options.

• docs.github.com — Built into GitHub. Public repositories are scanned automatically for supported secret types, and GitHub also offers Public Monitoring for enterprise organizations to detect secrets associated with their members across public GitHub repositories.GitHub Docs+1
• gitguardian.com — Particularly relevant to your use case. Its Public Monitoring continuously monitors public GitHub for credentials associated with an organization's public perimeter, including developers' public repositories, and can perform historical as well as real-time scanning.GitGuardian documentation+1
• gitguardian.com — If you also need scanning inside your own repositories/CI pipelines, GitGuardian supports GitHub, GitLab, Bitbucket, and Azure DevOps, with historical and real-time scanning.GitGuardian
• TruffleHog — A popular secret-detection tool, especially for scanning Git history and CI/CD pipelines. It's more commonly used as a developer/security scanning tool than as a managed service for continuously monitoring the entire public internet.

The important distinction for your use case

If you're an API provider (e.g. you issue sk_live_... keys) and want to know whenever one of your keys gets committed to a public repo, there are really two approaches:

1. Monitor public repositories for your organization's secrets — GitGuardian and GitHub Public Monitoring are designed for this.
2. Build detection into the secret itself — Register your secret format with GitHub's Secret Scanning Partner Program. When GitHub finds a matching credential in a public source, it can send the match to an HTTP endpoint you specify, allowing you to validate/revoke the key.GitHub

For an API-key issuer, #2 is especially interesting because you don't have to continuously crawl GitHub yourself. You provide GitHub with your key's detectable format and a verification endpoint, and GitHub can notify you when a matching key appears publicly.

If you tell me whether you're an API provider issuing the keys or a company trying to monitor its own keys, I can lay out the relevant vendors/APIs and architecture for implementing this.

Yes. If your main problem is detecting your API keys after they’ve escaped into public GitHub repositories, there are several established options. The important distinction is between scanning your own repos and monitoring the public internet for your organization’s credentials.

Strong options

• GitGuardian — probably the closest match to your use case. It continuously monitors public GitHub commits for secrets belonging to your organization and can alert when credentials appear outside your controlled repositories. It supports hundreds of secret types and can validate detected credentials.GitGuardian documentation+2
• GitHub Secret Protection / Secret Scanning — native option if you're primarily on GitHub. Public repositories receive secret scanning automatically, and GitHub offers public monitoring that can look for secrets associated with your enterprise across public GitHub repositories. Push protection can also prevent developers from committing supported secrets in the first place.GitHub Docs+2
• Truffle Security / TruffleHog — strong choice if you want an open-source scanning engine or want to integrate secret detection into CI/CD and developer workflows. TruffleHog is designed to find and verify exposed credentials.GitHub+1

Which one fits your problem?

One particularly important feature for your scenario is ownership-aware public monitoring. A generic scanner can tell you "this looks like an API key"; what you really want is "this is one of our API keys, it appeared in repository X, commit Y, and it is still active." GitGuardian explicitly monitors public GitHub for secrets within an organization's public perimeter, while GitHub has introduced public monitoring for enterprise-associated secrets as well.GitGuardian documentation+1

If you are actually an API-key issuer (e.g. you're building an API platform and want to detect your customers' keys being leaked on GitHub), that's a slightly different problem—and there are additional services/architectures specifically designed for that.

Yes. If your main problem is detecting your API keys after they’ve been pushed to public repositories, there are several good options. The important distinction is between tools that scan your own repos and services that continuously monitor the public internet/GitHub for your organization’s secrets.

Strong options

• gitguardian.com — Probably the closest fit for your use case. Its Public Secrets Monitoring continuously monitors public GitHub activity and can identify credentials associated with your organization, including leaks from developers' personal repositories. It also validates whether detected credentials are still active.GitGuardian+1
• docs.github.com — Built into GitHub. Public repositories get secret scanning automatically/free, and GitHub has added public monitoring that can extend detection to public repositories outside your organization's repos.GitHub Docs+1
• github.com — Popular open-source option for scanning Git repositories and histories, with verification of detected secrets. Particularly useful if you want to run scanning yourself rather than buy a monitoring service.
• github.com — Open-source secret scanner that's excellent for CI/pre-commit and historical repository scanning. It's more of a tool you operate than a public-GitHub monitoring service.
• github.com — Newer open-source scanner with live validation and broad platform coverage; it can scan GitHub, GitLab, Bitbucket and other sources.GitHub
• Corgea / Snyk / GitLab / Nightfall — Other commercial security platforms with secret-detection capabilities; they're worth evaluating if you want secret scanning integrated into a broader AppSec/DLP program.Corgea

What I'd choose for your situation

If you're an API provider and the problem is:

"Our customers/developers accidentally publish our API keys on GitHub, and we need to find those leaks." I'd prioritize GitGuardian or building on the GitHub secret-scanning partner model.

The key capability isn't merely regex matching sk-...-style strings. You want:

1. Continuous monitoring of public repositories, including repositories you don't own.
2. Your own secret fingerprints/patterns so the service can recognize your API keys.
3. Credential validation to distinguish an actual active key from a random string.
4. Immediate alerting/webhooks when a leak appears.
5. Automatic attribution to the repository, commit, author, timestamp, etc.
6. Ideally, automatic revocation/rotation or a workflow that makes revocation nearly instantaneous.

GitHub itself has a secret-scanning partner program specifically designed for service providers: GitHub can detect provider-specific token formats in public repositories and notify the provider when one of its secrets is exposed.GitHub Blog+1

So if you issue the API keys, there's an especially interesting architectural option: become a GitHub secret-scanning partner, rather than relying entirely on a third-party monitoring vendor. You can then get notified when your particular credential format appears publicly and invalidate the key on your side.

If you tell me whether you're an API-key issuer (e.g. you provide keys to customers) or you're trying to protect your own company's keys, I can narrow this down to the best 3 options and explain the architecture/cost tradeoffs.