groq-security-basics

name	groq-security-basics
description	Apply Groq security best practices for API key management and data protection. Use when securing API keys, implementing least privilege access, or auditing Groq security configuration. Trigger with phrases like "groq security", "groq secrets", "secure groq", "groq API key security".
allowed-tools	Read, Write, Grep
version	1.11.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","groq","api","security","audit"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

Groq Security Basics

Overview

Security practices for Groq API keys and data flowing through Groq's inference API. Groq uses a single API key type (gsk_ prefix) with full access -- there are no scoped tokens -- so key management and rotation are critical.

This skill walks through six hardening steps end to end. The essentials live here; deep code and full command sequences are extracted into references/ for progressive disclosure:

• references/implementation.md — server-side proxy pattern, prompt-injection defense, audit logging (TypeScript).
• references/examples.md — copy-ready key-storage, rotation, and git-leak-prevention commands.

Prerequisites

• Groq account at console.groq.com
• Understanding of environment variable management
• Secret management solution for production (Vault, AWS Secrets Manager, etc.)

Key Security Facts

• Groq API keys start with gsk_ and grant full API access
• There are no read-only or scoped keys -- every key can call every endpoint
• Keys are created at console.groq.com/keys and cannot be viewed after creation
• Rate limits are per-organization, not per-key
• Groq does not store prompt data for training (see privacy policy)

Instructions

Work through the six steps in order. Each summary below is enough to act on; drill into the linked reference for the full code.

Step 1: Secure Key Storage by Environment

Keep the key out of source. Use a .env.local (git-ignored) for development and a platform secret manager (Vercel / AWS / GCP / GitHub Actions) for production. Use Write to create the .env.local and .gitignore entries:

echo "GROQ_API_KEY=gsk_dev_key_here" > .env.local
echo -e ".env\n.env.local\n.env.*.local" >> .gitignore

Full per-platform commands: references/examples.md Example 1.

Step 2: Key Rotation Procedure

Both keys work simultaneously, so rotation is zero-downtime: create a date-named key, deploy it, verify with a 200 from /v1/models, monitor 24h, then delete the old key. Full sequence: Example 2.