> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/cloudflare/cloudflare-typescript/llms.txt
> Use this file to discover all available pages before exploring further.

# Leaked Credential Checks

> Detect and prevent use of compromised credentials on your applications

The Leaked Credential Checks API helps protect your applications by detecting when users attempt to log in with credentials that have been exposed in data breaches. This service checks login attempts against a database of known leaked credentials.

## Initialize the Leaked Credential Checks resource

```typescript theme={null}
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env.CLOUDFLARE_API_TOKEN,
});

const leakedCredentialChecks = client.leakedCredentialChecks;
```

## Configuration

### Enable Leaked Credential Checks

Enable or disable Leaked Credential Checks for a zone.

```typescript theme={null}
const config = await client.leakedCredentialChecks.create({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
  enabled: true,
});
```

<ParamField path="zone_id" type="string" required>
  Zone identifier
</ParamField>

<ParamField body="enabled" type="boolean">
  Enable or disable Leaked Credential Checks
</ParamField>

### Get configuration status

Retrieve the current status of Leaked Credential Checks.

```typescript theme={null}
const status = await client.leakedCredentialChecks.get({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
});

console.log(`Leaked Credential Checks enabled: ${status.enabled}`);
```

## Detections

Manage custom detection patterns for identifying username and password fields in login requests.

### Create detection

Create a user-defined detection pattern.

```typescript theme={null}
const detection = await client.leakedCredentialChecks.detections.create({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
  username_expression: 'http.request.body.form["email"]',
  password_expression: 'http.request.body.form["password"]',
});
```

<ParamField path="zone_id" type="string" required>
  Zone identifier
</ParamField>

<ParamField body="username_expression" type="string">
  Ruleset expression to match the username in a request. For example:

  * `http.request.body.form["email"]`
  * `http.request.body.json["user"]`
  * `http.request.headers["x-username"][0]`
</ParamField>

<ParamField body="password_expression" type="string">
  Ruleset expression to match the password in a request. For example:

  * `http.request.body.form["password"]`
  * `http.request.body.json["pass"]`
  * `http.request.body.form["user_password"]`
</ParamField>

### Update detection

Update an existing detection pattern.

```typescript theme={null}
const detection = await client.leakedCredentialChecks.detections.update(
  '18a14bafaa8eb1df04ce683ec18c765e',
  {
    zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
    username_expression: 'http.request.body.json["username"]',
    password_expression: 'http.request.body.json["password"]',
  }
);
```

### List detections

List all user-defined detection patterns.

```typescript theme={null}
// Automatically fetches more pages as needed
for await (const detection of client.leakedCredentialChecks.detections.list({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
})) {
  console.log(detection.id);
  console.log('Username:', detection.username_expression);
  console.log('Password:', detection.password_expression);
}
```

### Get detection

Retrieve a specific detection pattern.

```typescript theme={null}
const detection = await client.leakedCredentialChecks.detections.get(
  '18a14bafaa8eb1df04ce683ec18c765e',
  { zone_id: '023e105f4ecef8ad9ca31a8372d0c353' }
);
```

### Delete detection

Remove a user-defined detection pattern.

```typescript theme={null}
const result = await client.leakedCredentialChecks.detections.delete(
  '18a14bafaa8eb1df04ce683ec18c765e',
  { zone_id: '023e105f4ecef8ad9ca31a8372d0c353' }
);
```

## Use cases

### Protect login forms

Set up detection for a standard HTML form login.

```typescript theme={null}
// Enable Leaked Credential Checks
await client.leakedCredentialChecks.create({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
  enabled: true,
});

// Create detection pattern for form-based login
await client.leakedCredentialChecks.detections.create({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
  username_expression: 'http.request.body.form["email"]',
  password_expression: 'http.request.body.form["password"]',
});
```

### Protect JSON API logins

Set up detection for a JSON-based authentication API.

```typescript theme={null}
await client.leakedCredentialChecks.detections.create({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
  username_expression: 'http.request.body.json["username"]',
  password_expression: 'http.request.body.json["password"]',
});
```

### Multiple login endpoints

Create multiple detection patterns for different login endpoints.

```typescript theme={null}
// Main login endpoint
await client.leakedCredentialChecks.detections.create({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
  username_expression: 'http.request.body.form["username"]',
  password_expression: 'http.request.body.form["password"]',
});

// API login endpoint
await client.leakedCredentialChecks.detections.create({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
  username_expression: 'http.request.body.json["user"]',
  password_expression: 'http.request.body.json["pass"]',
});

// Admin login with different field names
await client.leakedCredentialChecks.detections.create({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
  username_expression: 'http.request.body.form["admin_email"]',
  password_expression: 'http.request.body.form["admin_password"]',
});
```

### Audit existing detections

Review all configured detection patterns.

```typescript theme={null}
console.log('Configured detection patterns:');

let count = 0;
for await (const detection of client.leakedCredentialChecks.detections.list({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
})) {
  count++;
  console.log(`\nDetection ${count}:`);
  console.log(`  ID: ${detection.id}`);
  console.log(`  Username: ${detection.username_expression}`);
  console.log(`  Password: ${detection.password_expression}`);
}

console.log(`\nTotal detections: ${count}`);
```

## Response types

### LeakedCredentialCheckCreateResponse

Configuration status for Leaked Credential Checks.

<ResponseField name="enabled" type="boolean">
  Whether Leaked Credential Checks are enabled
</ResponseField>

### LeakedCredentialCheckGetResponse

Current status of Leaked Credential Checks.

<ResponseField name="enabled" type="boolean">
  Whether Leaked Credential Checks are enabled
</ResponseField>

### DetectionCreateResponse

User-defined detection pattern.

<ResponseField name="id" type="string">
  Unique ID for this custom detection
</ResponseField>

<ResponseField name="username_expression" type="string">
  Ruleset expression to match the username in a request
</ResponseField>

<ResponseField name="password_expression" type="string">
  Ruleset expression to match the password in a request
</ResponseField>

### DetectionListResponse

List item for a detection pattern.

<ResponseField name="id" type="string">
  Unique ID for this custom detection
</ResponseField>

<ResponseField name="username_expression" type="string">
  Ruleset expression to match the username
</ResponseField>

<ResponseField name="password_expression" type="string">
  Ruleset expression to match the password
</ResponseField>

<ResponseField name="created_at" type="string">
  When the detection was created
</ResponseField>

<ResponseField name="updated_at" type="string">
  When the detection was last updated
</ResponseField>

## Best practices

<Tip>
  **Test your expressions**: Before deploying to production, test your username and password expressions to ensure they correctly identify the credential fields in your login requests.
</Tip>

<Tip>
  **Multiple endpoints**: If your application has multiple login endpoints with different field names, create separate detection patterns for each.
</Tip>

<Tip>
  **Monitor alerts**: Set up monitoring for leaked credential alerts to quickly identify and respond to potential account compromises.
</Tip>

<Warning>
  Leaked Credential Checks can only detect credentials that match known data breaches. It should be used as part of a comprehensive security strategy that includes strong password policies, multi-factor authentication, and account monitoring.
</Warning>

## Expression examples

Common expression patterns for different login implementations:

### HTML form POST

```javascript theme={null}
// Standard form fields
username: http.request.body.form["username"]
password: http.request.body.form["password"]

// Email-based login
username: http.request.body.form["email"]
password: http.request.body.form["password"]
```

### JSON API

```javascript theme={null}
// Standard JSON fields
username: http.request.body.json["username"]
password: http.request.body.json["password"]

// Nested JSON
username: http.request.body.json["credentials"]["user"]
password: http.request.body.json["credentials"]["pass"]
```

### Headers

```javascript theme={null}
// Basic auth alternative
username: http.request.headers["x-username"][0]
password: http.request.headers["x-password"][0]
```

## Related resources

* [Bot Management](/api-reference/bot-management)
* [Security Center](/api-reference/security-center)
* [Leaked Credentials Documentation](https://developers.cloudflare.com/waf/managed-rules/check-for-exposed-credentials/)