fireflies-security-basics

name	fireflies-security-basics
description	Apply Fireflies.ai security best practices for API keys and webhook verification. Use when securing API keys, verifying webhook signatures, or auditing Fireflies.ai security configuration. Trigger with phrases like "fireflies security", "fireflies secrets", "secure fireflies", "fireflies webhook signature", "fireflies HMAC".
allowed-tools	Read, Write, Grep
version	1.11.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","fireflies","api","security"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

Fireflies.ai Security Basics

Overview

Security essentials for Fireflies.ai: API key management, webhook HMAC-SHA256 signature verification, transcript access controls, and audit practices.

Prerequisites

• Fireflies.ai API key
• Understanding of environment variables
• HTTPS endpoint for webhooks (required by Fireflies)

Instructions

Step 1: Secure API Key Storage

# .env (NEVER commit)
FIREFLIES_API_KEY=your-api-key
FIREFLIES_WEBHOOK_SECRET=your-16-to-32-char-secret

# .gitignore
.env
.env.local
.env.*.local

Pre-commit hook to catch leaked keys:

#!/bin/bash
# .git/hooks/pre-commit
if git diff --cached --name-only | xargs grep -l 'FIREFLIES_API_KEY\s*=' 2>/dev/null; then
  echo "ERROR: Potential API key in commit. Remove before committing."
  exit 1
fi

Step 2: Webhook Signature Verification (HMAC-SHA256)

Fireflies signs webhook payloads with HMAC-SHA256. The signature arrives in the x-hub-signature header.

import crypto from "crypto";

function verifyFirefliesWebhook(
  payload: string,
  signature: string,
  secret: string
): boolean {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(payload)
    .digest("hex");

  
   crypto.(
    .(signature),
    .(expected)
  );
}


 express  ;
 app = ();

app.(,
  express.({ :  }),
   {
     signature = req.[]  ;
     payload = req..();

     (!signature || !(payload, signature, process..!)) {
      .();
       res.().({ :  });
    }

     event = .(payload);
    .();
    res.().({ :  });
  }
);