vastai-security-basics

name	vastai-security-basics
description	Apply Vast.ai security best practices for API keys and instance access. Use when securing API keys, hardening SSH access to GPU instances, or auditing Vast.ai security configuration. Trigger with phrases like "vastai security", "vastai secrets", "secure vastai", "vastai API key security", "vastai ssh security".
allowed-tools	Read, Write, Grep
version	1.11.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","vast-ai","api","security"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

Vast.ai Security Basics

Overview

Security best practices for Vast.ai API keys, SSH access to GPU instances, data protection on rented hardware, and credential management. Vast.ai instances run as root on shared hardware, requiring careful attention to data lifecycle.

Prerequisites

• Vast.ai account with API key
• Understanding of SSH key management
• Secrets manager available (optional but recommended)

Instructions

Step 1: API Key Management

# Never commit API keys to git
echo '.vast_api_key' >> .gitignore
echo '.env' >> .gitignore

# Use environment variables, not files in repos
export VASTAI_API_KEY="$(vault kv get -field=api_key secret/vastai)"

# Rotate keys periodically at cloud.vast.ai > Account > API Keys

# Fail fast on missing credentials
import os

def get_api_key():
    key = os.environ.get("VASTAI_API_KEY")
    if not key:
        key_file = os.path.expanduser("~/.vast_api_key")
        if os.path.exists(key_file):
            key = open(key_file).read().strip()
    if not key:
        raise ValueError("VASTAI_API_KEY not set and ~/.vast_api_key not found")
    return key

Step 2: SSH Key Security

# Generate a dedicated key pair for Vast.ai instances
ssh-keygen -t ed25519 -f ~/.ssh/vastai_key -C "vastai-instances" -N ""

# Upload public key at cloud.vast.ai > Account > SSH Keys

# Use the dedicated key for connections
ssh -i ~/.ssh/vastai_key -p PORT root@HOST