lolcreds

Public credential defaults and exposure patterns for authorized security testing.

Baidu Qianfan / Wenxin Workshop

Baidu AI CloudAI API1 credential

Credentials1 documented
01

API Key / Secret Key

baidu-qianfan / api-key-secret-key

Baidu Qianfan / Wenxin Workshop SDKs use QIANFAN_AK/QIANFAN_SK for LLM API auth, QIANFAN_ACCESS_KEY/QIANFAN_SECRET_KEY for console/IAM features, and QIANFAN_ACCESS_TOKEN when a derived access token is supplied directly.

user definedsecretAPI key

Looks like

example
example

Opaque Qianfan access-token/key value; use only with Qianfan env, token response, or SDK context

abcdefghijklmnopqrstuvwxyz012345

Location

environment
QIANFAN_AK, QIANFAN_SK, QIANFAN_ACCESS_KEY, QIANFAN_SECRET_KEY, QIANFAN_ACCESS_TOKEN

Exact credential-value environment variables supported by the official qianfan Python SDK

http header
Authorization

Bearer-style request credential when integrations use an access token header

http response

Token-exchange responses that return access_token values

source code

SDK examples, notebooks, server config, tests, and committed integration code

secret store

CI/CD variables, Baidu Cloud secret stores, hosted app settings, and notebook/service vaults

logs

OAuth/token exchange logs and request URLs containing access_token

Notes

Baidu credentials often appear as a key pair plus a generated access token. Rotate the API Key / Secret Key pair if either half or any derived access token is exposed.

Scope

Authorized use

LOLCreds helps map the credential surface of real products: known defaults, generated values, credential locations, and exposure patterns.