From 78aa75a9ffe7d09363e115cbf6cd1bf5c22ba6e6 Mon Sep 17 00:00:00 2001
From: Siva dheeraj <141407819+Sivadheeraj5356@users.noreply.github.com>
Date: Tue, 27 Oct 2026 10:44:00 +0530
Subject: [PATCH 1/3] fix: match customer-portal keys with -gov and -rl
 prefixes

---
 worker/src/lib/util/apiKeyRegex.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/worker/src/lib/util/apiKeyRegex.ts b/worker/src/lib/util/apiKeyRegex.ts
index bdfeec5b4e..b306689551 100644
--- a/worker/src/lib/util/apiKeyRegex.ts
+++ b/worker/src/lib/util/apiKeyRegex.ts
@@ -11,6 +11,6 @@ export const HELICONE_API_KEY_REGEX = [
   /^pk-helicone-[a-z0-9]{7}-[a-z0-9]{7}-[a-z0-9]{7}-[a-z0-9]{7}$/,
   /^pk-helicone-eu-[a-z0-9]{7}-[a-z0-9]{7}-[a-z0-9]{7}-[a-z0-9]{7}$/,
   /^sk-helicone-eu-[a-z0-9]{7}-[a-z0-9]{7}-[a-z0-9]{7}-[a-z0-9]{7}$/,
-  /^[sp]k(-helicone)?(-eu)?(-cp)?-\w{7}-\w{7}-\w{7}-\w{7}$/,
+  /^[sp]k(-helicone)?(-eu)?(-cp)?(-gov)?(-rl)?-\w{7}-\w{7}-\w{7}-\w{7}$/,
   ...HELICONE_RATE_LIMITED_API_KEY_REGEX,
 ];

From 16bdaa465700e184e508c65e2f94d796b9326172 Mon Sep 17 00:00:00 2001
From: Siva dheeraj <141407819+Sivadheeraj5356@users.noreply.github.com>
Date: Tue, 27 Oct 2026 10:44:19 +0530
Subject: [PATCH 2/3] fix: match customer-portal keys with -gov and -rl
 prefixes (jawn)

---
 valhalla/jawn/src/lib/requestWrapper/requestWrapper.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/valhalla/jawn/src/lib/requestWrapper/requestWrapper.ts b/valhalla/jawn/src/lib/requestWrapper/requestWrapper.ts
index 689313dd90..59ec1636ff 100644
--- a/valhalla/jawn/src/lib/requestWrapper/requestWrapper.ts
+++ b/valhalla/jawn/src/lib/requestWrapper/requestWrapper.ts
@@ -35,7 +35,7 @@ export const HELICONE_API_KEY_REGEX = [
   /^pk-helicone-[a-z0-9]{7}-[a-z0-9]{7}-[a-z0-9]{7}-[a-z0-9]{7}$/,
   /^pk-helicone-eu-[a-z0-9]{7}-[a-z0-9]{7}-[a-z0-9]{7}-[a-z0-9]{7}$/,
   /^sk-helicone-eu-[a-z0-9]{7}-[a-z0-9]{7}-[a-z0-9]{7}-[a-z0-9]{7}$/,
-  /^[sp]k(-helicone)?(-eu)?(-cp)?-\w{7}-\w{7}-\w{7}-\w{7}$/,
+  /^[sp]k(-helicone)?(-eu)?(-cp)?(-gov)?(-rl)?-\w{7}-\w{7}-\w{7}-\w{7}$/,
   ...HELICONE_RATE_LIMITED_API_KEY_REGEX,
 ];
 

From 81bae5f4209aa9aa990340096f9bef83ff229958 Mon Sep 17 00:00:00 2001
From: Siva dheeraj <141407819+Sivadheeraj5356@users.noreply.github.com>
Date: Tue, 27 Oct 2026 10:44:35 +0530
Subject: [PATCH 3/3] test: cover customer-portal -gov/-rl key shapes in
 containsHeliconeKey

---
 worker/test/security/outboundHeaders.spec.ts | 26 ++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/worker/test/security/outboundHeaders.spec.ts b/worker/test/security/outboundHeaders.spec.ts
index 4a2361f9b7..55da13cea2 100644
--- a/worker/test/security/outboundHeaders.spec.ts
+++ b/worker/test/security/outboundHeaders.spec.ts
@@ -31,6 +31,32 @@ describe("containsHeliconeKey", () => {
     ).toBe(true);
   });
 
+  it("detects customer-portal keys with -rl and -gov prefixes", () => {
+    // generated by buildHeliconeApiKey: [sp]k(-eu)?-cp(-gov)?(-rl)?-<4x7>
+    expect(
+      containsHeliconeKey("Bearer sk-cp-rl-abcdefg-hijklmn-opqrstu-vwxyz12")
+    ).toBe(true);
+    expect(
+      containsHeliconeKey("Bearer sk-cp-gov-abcdefg-hijklmn-opqrstu-vwxyz12")
+    ).toBe(true);
+    expect(
+      containsHeliconeKey("pk-cp-gov-rl-abcdefg-hijklmn-opqrstu-vwxyz12")
+    ).toBe(true);
+    expect(
+      containsHeliconeKey("Bearer sk-eu-cp-rl-abcdefg-hijklmn-opqrstu-vwxyz12")
+    ).toBe(true);
+    expect(
+      containsHeliconeKey("pk-eu-cp-gov-abcdefg-hijklmn-opqrstu-vwxyz12")
+    ).toBe(true);
+    // governance / rate-limited org keys
+    expect(
+      containsHeliconeKey("Bearer sk-helicone-gov-abcdefg-hijklmn-opqrstu-vwxyz12")
+    ).toBe(true);
+    expect(
+      containsHeliconeKey("Bearer sk-helicone-eu-gov-rl-abcdefg-hijklmn-opqrstu-vwxyz12")
+    ).toBe(true);
+  });
+
   it("does not flag provider keys", () => {
     expect(containsHeliconeKey("Bearer sk-proj-abc123DEF456")).toBe(false);
     expect(containsHeliconeKey("sk-ant-api03-xyz")).toBe(false);