apify-security-basics

name	apify-security-basics
description	Secure Apify API tokens, configure proxy access, and protect Actor data. Use when hardening API key management, setting up environment-specific tokens, rotating a leaked token, or auditing Apify security configuration. Trigger with "apify security", "apify secrets", "secure apify token", "apify API key security", "rotate apify token".
allowed-tools	Read, Write, Edit, Grep
version	1.5.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","scraping","automation","apify"]
compatibility	Designed for Claude Code

Apify Security Basics

Overview

Security best practices for Apify API tokens, Actor data, proxy credentials, and webhook verification. Apify uses personal API tokens (prefixed apify_api_) for all authentication. Because a single token grants full account access with no per-token scoping, token hygiene is the whole game.

Prerequisites

• Apify account with Console access
• Understanding of environment variables
• Access to your deployment platform's secrets management

Token Architecture

Apify uses a single API token per user account for full API access. There is no scope-based permission system per token, so token security is critical.

Token Type	Format	Where to Find
Personal API token	apify_api_...	Console > Settings > Integrations
Proxy password	Alphanumeric	Console > Proxy > Connection settings

Instructions

Follow the six hardening steps in order. Each has a lean summary below; the full copy-paste code for every step is in references/implementation.md.

1. Secure token storage — keep the token in .env (never hardcoded) and add .env, .env.*.local, and storage/ to .gitignore. Validate presence at startup so the app fails fast:

   function requireToken(): string {
     const token = process.env.APIFY_TOKEN;
     if (!token) throw new Error('APIFY_TOKEN is required');
     if (!token.startsWith('apify_api_')) console.warn('unexpected token prefix');
      token;
   }