Audit your non-human identities in minutes

Upload an export of service accounts, API keys, tokens and app registrations. You'll see which are stale, unowned or over-privileged, which keys are older than 90 days, and which AI agents hold admin scopes, mapped to the OWASP Non-Human Identities Top 10.

Your inventory stays in your browser. The file is read on your computer without uploading its contents. The page may request static files from this site and, if analytics are enabled, contact the configured analytics services. Export names and metadata only, never secret values.

Upload a CSV or JSON export Or paste it here, with the header row

Stale if unused for more than

Key too old after

Your non-human identity audit

0 / 100

By OWASP NHI Top 10 risk

Identities that need action

Identity	Findings	Owner	Privilege

A planning aid based on the data you provide, not a penetration test or an audit opinion. Not affiliated with or endorsed by OWASP.

Exports it recognises

AWS IAM credential report: In the IAM console open Credential report and download it, or run aws iam generate-credential-report then aws iam get-credential-report --query Content --output text | base64 --decode > report.csv. Upload the CSV as it is. IAM users with console access and no keys are skipped as people.
Microsoft Entra ID app registrations or service principals: Export app registrations with Microsoft Graph PowerShell (Get-MgApplication -All) to CSV with the columns DisplayName, AppId, CreatedDateTime, Owners, Permissions, SecretStartDateTime and SecretEndDateTime. Add LastSignInDateTime from service principal sign-in activity if you have it.
Okta API tokens: Paste the JSON returned by GET /api/v1/api-tokens (Security › API › Tokens lists the same tokens). Okta documents that API tokens inherit the privilege level of the admin who created them, so every token is checked as privileged.
GitHub fine-grained personal access tokens (organization): Paste the JSON from gh api /orgs/ORG/personal-access-tokens --paginate (fine-grained tokens with access to your organization).
Google Cloud service account keys: Paste the JSON from gcloud iam service-accounts keys list --iam-account=SA_EMAIL --format=json, or the same fields as CSV. Google-managed keys are rotated by Google and aren't flagged for age.
Google Workspace domain-wide delegation: In the Admin console, domain-wide delegation lists each client's ID, name and OAuth scopes. Put them in a CSV with the columns Client ID, Name and OAuth scopes.

Any other CSV with a header row works too: columns such as name, owner, privilege, last used, last rotated and expires are matched by name, and you can change the mapping. Step-by-step export instructions.

What it finds

Stale identities: not used within your limit, or never used.
Unowned identities: no named owner (when the export has an owner column).
Over-privileged identities: admin, owner, wildcard or tenant-wide scopes, root account keys, and tokens that inherit an admin's permissions.
Keys older than 90 days (or your limit), and secrets that never expire.
AI agents holding admin scopes.
Shared identities, identities used across environments and service accounts used by people.

The OWASP Non-Human Identities Top 10

Risk	What to fix
NHI1 Improper offboarding	Give every identity a named owner; disable identities unused beyond your limit, then delete them after a grace period.
NHI2 Secret leakage	Keep secrets only in a secrets manager and scan code, CI logs, tickets and chat for leaked ones.
NHI3 Vulnerable third-party NHI	Review OAuth apps, integrations and delegated access; remove unused ones and cut scopes to read-only where possible.
NHI4 Insecure authentication	Replace passwords and static keys with short-lived tokens or workload identity federation.
NHI5 Overprivileged NHI	Replace admin, owner, wildcard and tenant-wide scopes with the narrowest permission that works.
NHI6 Insecure cloud deployment configurations	Use OIDC federation from CI/CD to your clouds instead of stored static credentials.
NHI7 Long-lived secrets	Set an expiry on every secret and rotate static keys within your rotation limit.
NHI8 Environment isolation	Use separate identities and secrets for development, staging and production.
NHI9 NHI reuse	Give each application or agent its own identity so one compromise doesn't spread.
NHI10 Human use of NHI	Stop people using service identities; give them personal accounts with MFA and just-in-time access.

AI agents are non-human identities too

Every AI agent that reads email, queries a database or calls an API acts through a credential. Give each agent its own identity, a named owner and the narrowest scopes its job needs. For a least-privilege checklist and a tool that compares granted and needed permissions, use Agent Permission Audit.

Questions

Is my data uploaded?

No. The file is read in your browser without uploading its contents. The page may request static files from this site. Export names and metadata only; never include secret values.

Which exports are recognised?

AWS IAM credential reports, Microsoft Entra ID app registrations, Okta API tokens, GitHub fine-grained tokens for an organization, Google Cloud service account keys and Google Workspace domain-wide delegation, as CSV or as the JSON the API returns. Any other CSV works too: columns are matched by name and you can change the mapping.

What counts as stale, over-privileged or an old key?

Stale: not used within the limit you choose (90 days by default) or never used. Over-privileged: admin, owner, wildcard or tenant-wide scopes, such as Directory.ReadWrite.All, full Gmail access or organization member administration. Old key: a key or secret older than your rotation limit (90 days by default).

How are AI agents recognised?

By name or type: identities whose name or type mentions an agent, bot, copilot, assistant, GPT, LLM or an AI provider. Holding admin scopes as an agent is reported separately because an agent acts on instructions it reads.

How is the score calculated?

It's the share of identities with no high or critical finding. An identity with only medium findings counts as 0.4 of a problem; static credentials alone don't lower the score.

Sources

OWASP Non-Human Identities Top 10
Okta: create an API token (token privilege inheritance)
Vendor export formats are linked in the list above. Checked 28 September 2026.