| name | groq-security-basics |
| description | Apply Groq security best practices for API key management and data protection.
Use when securing API keys, implementing least privilege access,
or auditing Groq security configuration.
Trigger with phrases like "groq security", "groq secrets",
"secure groq", "groq API key security".
|
| allowed-tools | Read, Write, Grep |
| version | 1.11.0 |
| license | MIT |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| tags | ["saas","groq","api","security","audit"] |
| compatibility | Designed for Claude Code, also compatible with Codex and OpenClaw |
Groq Security Basics
Overview
Security practices for Groq API keys and data flowing through Groq's inference API. Groq uses a single API key type (gsk_ prefix) with full access -- there are no scoped tokens -- so key management and rotation are critical.
This skill walks through six hardening steps end to end. The essentials live
here; deep code and full command sequences are extracted into
references/ for progressive disclosure:
Prerequisites
- Groq account at console.groq.com
- Understanding of environment variable management
- Secret management solution for production (Vault, AWS Secrets Manager, etc.)
Key Security Facts
- Groq API keys start with
gsk_ and grant full API access
- There are no read-only or scoped keys -- every key can call every endpoint
- Keys are created at console.groq.com/keys and cannot be viewed after creation
- Rate limits are per-organization, not per-key
- Groq does not store prompt data for training (see privacy policy)
Instructions
Work through the six steps in order. Each summary below is enough to act on;
drill into the linked reference for the full code.
Step 1: Secure Key Storage by Environment
Keep the key out of source. Use a .env.local (git-ignored) for development
and a platform secret manager (Vercel / AWS / GCP / GitHub Actions) for
production. Use Write to create the .env.local and .gitignore entries:
echo "GROQ_API_KEY=gsk_dev_key_here" > .env.local
echo -e ".env\n.env.local\n.env.*.local" >> .gitignore
Full per-platform commands: references/examples.md Example 1.
Step 2: Key Rotation Procedure
Both keys work simultaneously, so rotation is zero-downtime: create a
date-named key, deploy it, verify with a 200 from /v1/models, monitor 24h,
then delete the old key. Full sequence: Example 2.
