diff --git a/main.go b/main.go
index 53f9fb7dc..01b36cfd7 100644
--- a/main.go
+++ b/main.go
@@ -566,6 +566,7 @@ func run(state overseer.State, logSync func() error) {
 	feature.DuoDetectorEnabled.Store(true)
 	feature.NewRelicLicenseKeyDetectorEnabled.Store(true)
 	feature.NewRelicBrowserKeyDetectorEnabled.Store(true)
+	feature.NewRelicUserKeyDetectorEnabled.Store(true)
 
 	conf := &config.Config{}
 	if *configFilename != "" {
diff --git a/pkg/detectors/newrelicuserkey/newrelicuserkey.go b/pkg/detectors/newrelicuserkey/newrelicuserkey.go
new file mode 100644
index 000000000..6ce52995a
--- /dev/null
+++ b/pkg/detectors/newrelicuserkey/newrelicuserkey.go
@@ -0,0 +1,147 @@
+package newrelicuserkey
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+
+	regexp "github.com/wasilibs/go-re2"
+
+	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
+	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
+	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detector_typepb"
+)
+
+type Scanner struct {
+	client *http.Client
+}
+
+// Ensure the Scanner satisfies the interfaces at compile time.
+var _ detectors.Detector = (*Scanner)(nil)
+
+var (
+	defaultClient = common.SaneHttpClient()
+	keyPat        = regexp.MustCompile(`\b(NRAK-[A-Z0-9]{27})\b`)
+)
+
+func (s Scanner) getClient() *http.Client {
+	if s.client != nil {
+		return s.client
+	}
+
+	return defaultClient
+}
+
+// Keywords are used for efficiently pre-filtering chunks.
+func (s Scanner) Keywords() []string { return []string{"nrak-"} }
+
+func (s Scanner) Type() detector_typepb.DetectorType {
+	return detector_typepb.DetectorType_NewRelicUserKey
+}
+
+func (s Scanner) Description() string {
+	return "A New Relic User API Key is an authentication token used to query data from New Relic via the NerdGraph API or REST API, allowing users to access account data and perform read operations securely. It is primarily used for interacting with New Relic’s query and configuration services."
+}
+
+func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	for _, match := range matches {
+		resMatch := strings.TrimSpace(match[1])
+
+		s1 := detectors.Result{
+			DetectorType: s.Type(),
+			Raw:          []byte(resMatch),
+			Redacted:     resMatch[:8] + "...",
+			SecretParts: map[string]string{
+				"key": resMatch,
+			},
+		}
+
+		if verify {
+			isVerified, extraData, verificationErr := s.verify(ctx, resMatch)
+			s1.Verified = isVerified
+			s1.ExtraData = extraData
+			if extraData != nil {
+				s1.SecretParts["region"] = extraData["region"]
+			}
+			s1.SetVerificationError(verificationErr)
+		}
+
+		results = append(results, s1)
+	}
+
+	return results, nil
+}
+
+type graphqlResponse struct {
+	Data struct {
+		RequestContext struct {
+			UserID string `json:"userId"`
+		} `json:"requestContext"`
+	} `json:"data"`
+}
+
+// verify checks if the provided key is valid by making a request to the New Relic NerdGraph API.
+// It sends a POST request to the NerdGraph API. A valid key will result in a 200 OK response.
+// Invalid key will return in 401 Unauthorized, and a key with incorrect region will return a 403 Forbidden.
+// https://docs.newrelic.com/docs/apis/nerdgraph/get-started/introduction-new-relic-nerdgraph/
+func (s Scanner) verify(ctx context.Context, key string) (bool, map[string]string, error) {
+	regionUrls := map[string]string{
+		"us": "https://api.newrelic.com/graphql",
+		"eu": "https://api.eu.newrelic.com/graphql",
+	}
+
+	errs := make([]error, 0, len(regionUrls))
+	for region, regionUrl := range regionUrls {
+		verified, extraData, err := s.verifyRegion(ctx, key, region, regionUrl)
+		if err != nil {
+			errs = append(errs, fmt.Errorf("error verifying region %s: %w", region, err))
+			continue
+		}
+		if verified {
+			return true, extraData, nil
+		}
+	}
+	return false, nil, errors.Join(errs...)
+}
+
+func (s Scanner) verifyRegion(ctx context.Context, key, region, regionUrl string) (bool, map[string]string, error) {
+	body := `{"query": "{ requestContext { userId } }"}`
+	req, err := http.NewRequestWithContext(
+		ctx, http.MethodPost, regionUrl, strings.NewReader(body))
+	if err != nil {
+		return false, nil, fmt.Errorf("error constructing request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("API-Key", key)
+
+	client := s.getClient()
+	res, err := client.Do(req)
+	if err != nil {
+		return false, nil, fmt.Errorf("error making request: %w", err)
+	}
+	defer func() {
+		_, _ = io.Copy(io.Discard, res.Body)
+		_ = res.Body.Close()
+	}()
+
+	switch res.StatusCode {
+	case http.StatusOK:
+		var resp graphqlResponse
+		if err := json.NewDecoder(res.Body).Decode(&resp); err != nil {
+			return false, nil, fmt.Errorf("error decoding response for region %s: %w", region, err)
+		}
+		return true, map[string]string{"region": region, "user_id": resp.Data.RequestContext.UserID}, nil
+	case http.StatusUnauthorized, http.StatusForbidden:
+		// 401 means the key is invalid, 403 means the region is incorrect
+		return false, nil, nil
+	default:
+		return false, nil, fmt.Errorf("unexpected status code for region %s: %d", region, res.StatusCode)
+	}
+}
diff --git a/pkg/detectors/newrelicuserkey/newrelicuserkey_integration_test.go b/pkg/detectors/newrelicuserkey/newrelicuserkey_integration_test.go
new file mode 100644
index 000000000..6ed84ef75
--- /dev/null
+++ b/pkg/detectors/newrelicuserkey/newrelicuserkey_integration_test.go
@@ -0,0 +1,161 @@
+//go:build detectors
+// +build detectors
+
+package newrelicuserkey
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/kylelemons/godebug/pretty"
+	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
+	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
+
+	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detector_typepb"
+)
+
+func TestNewRelicUserKey_FromChunk(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
+	defer cancel()
+	testSecrets, err := common.GetSecret(ctx, "trufflehog-testing", "detectors6")
+	if err != nil {
+		t.Fatalf("could not get test secrets from GCP: %s", err)
+	}
+
+	key := testSecrets.MustGetField("NEW_RELIC_USER_KEY")
+	keyEU := testSecrets.MustGetField("NEW_RELIC_USER_KEY_EU")
+	keyInactive := "NRAK-GDJSS4QZORUYIC1OGTRNGQMT5VH"
+
+	type args struct {
+		ctx    context.Context
+		data   []byte
+		verify bool
+	}
+	tests := []struct {
+		name    string
+		s       Scanner
+		args    args
+		want    []detectors.Result
+		wantErr bool
+	}{
+		{
+			name: "found, verified",
+			s:    Scanner{},
+			args: args{
+				ctx:    context.Background(),
+				data:   []byte(fmt.Sprintf("You can find a new relic user key %s within", key)),
+				verify: true,
+			},
+			want: []detectors.Result{
+				{
+					DetectorType: detector_typepb.DetectorType_NewRelicUserKey,
+					Verified:     true,
+					ExtraData: map[string]string{
+						"region":  "us",
+						"user_id": "1007651396",
+					},
+					SecretParts: map[string]string{
+						"key":    key,
+						"region": "us",
+					},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "found eu, verified",
+			s:    Scanner{},
+			args: args{
+				ctx:    context.Background(),
+				data:   []byte(fmt.Sprintf("You can find a new EU relic user key %s within", keyEU)),
+				verify: true,
+			},
+			want: []detectors.Result{
+				{
+					DetectorType: detector_typepb.DetectorType_NewRelicUserKey,
+					Verified:     true,
+					ExtraData: map[string]string{
+						"region":  "eu",
+						"user_id": "1007651478",
+					},
+					SecretParts: map[string]string{
+						"key":    keyEU,
+						"region": "eu",
+					},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "found, unverified",
+			s:    Scanner{},
+			args: args{
+				ctx:    context.Background(),
+				data:   []byte(fmt.Sprintf("You can find a new relic user key %s within", keyInactive)), // the secret would satisfy the regex but not pass validation
+				verify: true,
+			},
+			want: []detectors.Result{
+				{
+					DetectorType: detector_typepb.DetectorType_NewRelicUserKey,
+					Verified:     false,
+					SecretParts: map[string]string{
+						"key": keyInactive,
+					},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "not found",
+			s:    Scanner{},
+			args: args{
+				ctx:    context.Background(),
+				data:   []byte("You cannot find the secret within"),
+				verify: true,
+			},
+			want:    nil,
+			wantErr: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			s := Scanner{}
+			got, err := s.FromData(tt.args.ctx, tt.args.verify, tt.args.data)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("NewRelicUserKey.FromData() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			for i := range got {
+				if len(got[i].Raw) == 0 {
+					t.Fatalf("no raw secret present: \n %+v", got[i])
+				}
+				got[i].Raw = nil
+				if len(got[i].Redacted) == 0 {
+					t.Fatalf("no redacted secret present: \n %+v", got[i])
+				}
+				got[i].Redacted = ""
+			}
+			if diff := pretty.Compare(got, tt.want); diff != "" {
+				t.Errorf("NewRelicUserKey.FromData() %s diff: (-got +want)\n%s", tt.name, diff)
+			}
+		})
+	}
+}
+
+func BenchmarkFromData(benchmark *testing.B) {
+	ctx := context.Background()
+	s := Scanner{}
+	for name, data := range detectors.MustGetBenchmarkData() {
+		benchmark.Run(name, func(b *testing.B) {
+			b.ResetTimer()
+			for n := 0; n < b.N; n++ {
+				_, err := s.FromData(ctx, false, data)
+				if err != nil {
+					b.Fatal(err)
+				}
+			}
+		})
+	}
+}
diff --git a/pkg/detectors/newrelicuserkey/newrelicuserkey_test.go b/pkg/detectors/newrelicuserkey/newrelicuserkey_test.go
new file mode 100644
index 000000000..0659cdf07
--- /dev/null
+++ b/pkg/detectors/newrelicuserkey/newrelicuserkey_test.go
@@ -0,0 +1,80 @@
+package newrelicuserkey
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
+	"github.com/trufflesecurity/trufflehog/v3/pkg/engine/ahocorasick"
+)
+
+var (
+	validPattern   = "NRAK-GDJSS4QZORUYIC1OGTRNGQMT5VH"
+	invalidPattern = "NRAK-GDJSS4QZORUYIC1OGTRNGQMT5V"
+)
+
+func TestNewRelicUserKey_Pattern(t *testing.T) {
+	d := Scanner{}
+	ahoCorasickCore := ahocorasick.NewAhoCorasickCore([]detectors.Detector{d})
+	tests := []struct {
+		name  string
+		input string
+		want  []string
+	}{
+		{
+			name:  "valid pattern",
+			input: fmt.Sprintf("new relic user key = '%s'", validPattern),
+			want:  []string{validPattern},
+		},
+		{
+			name:  "invalid pattern",
+			input: fmt.Sprintf("new relic user key = '%s'", invalidPattern),
+			want:  []string{},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			matchedDetectors := ahoCorasickCore.FindDetectorMatches([]byte(test.input))
+			if len(matchedDetectors) == 0 {
+				t.Errorf("keywords '%v' not matched by: %s", d.Keywords(), test.input)
+				return
+			}
+
+			results, err := d.FromData(context.Background(), false, []byte(test.input))
+			if err != nil {
+				t.Errorf("error = %v", err)
+				return
+			}
+
+			if len(results) != len(test.want) {
+				if len(results) == 0 {
+					t.Errorf("did not receive result")
+				} else {
+					t.Errorf("expected %d results, only received %d", len(test.want), len(results))
+				}
+				return
+			}
+
+			actual := make(map[string]struct{}, len(results))
+			for _, r := range results {
+				if len(r.RawV2) > 0 {
+					actual[string(r.RawV2)] = struct{}{}
+				} else {
+					actual[string(r.Raw)] = struct{}{}
+				}
+			}
+			expected := make(map[string]struct{}, len(test.want))
+			for _, v := range test.want {
+				expected[v] = struct{}{}
+			}
+
+			if diff := cmp.Diff(expected, actual); diff != "" {
+				t.Errorf("%s diff: (-want +got)\n%s", test.name, diff)
+			}
+		})
+	}
+}
diff --git a/pkg/engine/defaults/defaults.go b/pkg/engine/defaults/defaults.go
index 8fe269d01..07c3c84e9 100644
--- a/pkg/engine/defaults/defaults.go
+++ b/pkg/engine/defaults/defaults.go
@@ -514,6 +514,7 @@ import (
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/newrelicinsightsinsertkey"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/newreliclicensekey"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/newrelicpersonalapikey"
+	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/newrelicuserkey"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/newsapi"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/newscatcher"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/nexmoapikey"
@@ -1429,6 +1430,7 @@ func buildDetectorList() []detectors.Detector {
 		&newrelicinsightsinsertkey.Scanner{},
 		&newreliclicensekey.Scanner{},
 		&newrelicpersonalapikey.Scanner{},
+		&newrelicuserkey.Scanner{},
 		&newsapi.Scanner{},
 		&newscatcher.Scanner{},
 		&nexmoapikey.Scanner{},
@@ -1872,6 +1874,8 @@ func buildDetectorList() []detectors.Detector {
 			return !feature.NewRelicLicenseKeyDetectorEnabled.Load()
 		case *newrelicbrowserkey.Scanner:
 			return !feature.NewRelicBrowserKeyDetectorEnabled.Load()
+		case *newrelicuserkey.Scanner:
+			return !feature.NewRelicUserKeyDetectorEnabled.Load()
 		default:
 			return false
 		}
diff --git a/pkg/engine/defaults/defaults_test.go b/pkg/engine/defaults/defaults_test.go
index 5e1bae884..2b7a6b58a 100644
--- a/pkg/engine/defaults/defaults_test.go
+++ b/pkg/engine/defaults/defaults_test.go
@@ -147,6 +147,7 @@ var excludedFromDefaultList = map[detector_typepb.DetectorType]struct{}{
 	detector_typepb.DetectorType_Duo:                       {},
 	detector_typepb.DetectorType_NewRelicLicenseKey:        {},
 	detector_typepb.DetectorType_NewRelicBrowserKey:        {},
+	detector_typepb.DetectorType_NewRelicUserKey:           {},
 
 	// Reserved / special types.
 	detector_typepb.DetectorType_CustomRegex: {}, // added dynamically via engine config, not via buildDetectorList()
diff --git a/pkg/feature/feature.go b/pkg/feature/feature.go
index d68b289af..52c09009f 100644
--- a/pkg/feature/feature.go
+++ b/pkg/feature/feature.go
@@ -44,6 +44,7 @@ var (
 	DuoDetectorEnabled                       atomic.Bool
 	NewRelicLicenseKeyDetectorEnabled        atomic.Bool
 	NewRelicBrowserKeyDetectorEnabled        atomic.Bool
+	NewRelicUserKeyDetectorEnabled           atomic.Bool
 )
 
 type AtomicString struct {
diff --git a/pkg/pb/detector_typepb/detector_type.pb.go b/pkg/pb/detector_typepb/detector_type.pb.go
index 6015daa5f..45df1ecfe 100644
--- a/pkg/pb/detector_typepb/detector_type.pb.go
+++ b/pkg/pb/detector_typepb/detector_type.pb.go
@@ -1119,6 +1119,7 @@ const (
 	DetectorType_Duo                                     DetectorType = 1063
 	DetectorType_NewRelicLicenseKey                      DetectorType = 1064
 	DetectorType_NewRelicBrowserKey                      DetectorType = 1065
+	DetectorType_NewRelicUserKey                         DetectorType = 1066
 )
 
 // Enum value maps for DetectorType.
@@ -2186,6 +2187,7 @@ var (
 		1063: "Duo",
 		1064: "NewRelicLicenseKey",
 		1065: "NewRelicBrowserKey",
+		1066: "NewRelicUserKey",
 	}
 	DetectorType_value = map[string]int32{
 		"Alibaba":                               0,
@@ -3250,6 +3252,7 @@ var (
 		"Duo":                               1063,
 		"NewRelicLicenseKey":                1064,
 		"NewRelicBrowserKey":                1065,
+		"NewRelicUserKey":                   1066,
 	}
 )
 
@@ -3285,7 +3288,7 @@ var File_detector_type_proto protoreflect.FileDescriptor
 var file_detector_type_proto_rawDesc = []byte{
 	0x0a, 0x13, 0x64, 0x65, 0x74, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x2e,
 	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0d, 0x64, 0x65, 0x74, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f,
-	0x74, 0x79, 0x70, 0x65, 0x2a, 0xfb, 0x8a, 0x01, 0x0a, 0x0c, 0x44, 0x65, 0x74, 0x65, 0x63, 0x74,
+	0x74, 0x79, 0x70, 0x65, 0x2a, 0x91, 0x8b, 0x01, 0x0a, 0x0c, 0x44, 0x65, 0x74, 0x65, 0x63, 0x74,
 	0x6f, 0x72, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x41, 0x6c, 0x69, 0x62, 0x61, 0x62,
 	0x61, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x41, 0x4d, 0x51, 0x50, 0x10, 0x01, 0x12, 0x07, 0x0a,
 	0x03, 0x41, 0x57, 0x53, 0x10, 0x02, 0x12, 0x09, 0x0a, 0x05, 0x41, 0x7a, 0x75, 0x72, 0x65, 0x10,
@@ -4397,11 +4400,13 @@ var file_detector_type_proto_rawDesc = []byte{
 	0x08, 0x12, 0x17, 0x0a, 0x12, 0x4e, 0x65, 0x77, 0x52, 0x65, 0x6c, 0x69, 0x63, 0x4c, 0x69, 0x63,
 	0x65, 0x6e, 0x73, 0x65, 0x4b, 0x65, 0x79, 0x10, 0xa8, 0x08, 0x12, 0x17, 0x0a, 0x12, 0x4e, 0x65,
 	0x77, 0x52, 0x65, 0x6c, 0x69, 0x63, 0x42, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x4b, 0x65, 0x79,
-	0x10, 0xa9, 0x08, 0x42, 0x41, 0x5a, 0x3f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
-	0x6d, 0x2f, 0x74, 0x72, 0x75, 0x66, 0x66, 0x6c, 0x65, 0x73, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74,
-	0x79, 0x2f, 0x74, 0x72, 0x75, 0x66, 0x66, 0x6c, 0x65, 0x68, 0x6f, 0x67, 0x2f, 0x76, 0x33, 0x2f,
-	0x70, 0x6b, 0x67, 0x2f, 0x70, 0x62, 0x2f, 0x64, 0x65, 0x74, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f,
-	0x74, 0x79, 0x70, 0x65, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x10, 0xa9, 0x08, 0x12, 0x14, 0x0a, 0x0f, 0x4e, 0x65, 0x77, 0x52, 0x65, 0x6c, 0x69, 0x63, 0x55,
+	0x73, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x10, 0xaa, 0x08, 0x42, 0x41, 0x5a, 0x3f, 0x67, 0x69, 0x74,
+	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x74, 0x72, 0x75, 0x66, 0x66, 0x6c, 0x65, 0x73,
+	0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x2f, 0x74, 0x72, 0x75, 0x66, 0x66, 0x6c, 0x65, 0x68,
+	0x6f, 0x67, 0x2f, 0x76, 0x33, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x70, 0x62, 0x2f, 0x64, 0x65, 0x74,
+	0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/proto/detector_type.proto b/proto/detector_type.proto
index 5942c7aee..ecaf753ff 100644
--- a/proto/detector_type.proto
+++ b/proto/detector_type.proto
@@ -1067,4 +1067,5 @@ enum DetectorType {
   Duo = 1063;
   NewRelicLicenseKey = 1064;
   NewRelicBrowserKey = 1065;
+  NewRelicUserKey = 1066;
 }