Exa Security Basics
Overview
Security best practices for Exa API integrations. Exa authenticates via the x-api-key header. Key security concerns include API key protection, content moderation for search results, domain filtering to prevent exposure to malicious sources, and query sanitization.
Prerequisites
- Exa API key from dashboard.exa.ai
- Understanding of environment variable management
.gitignore configured for secrets
Instructions
Step 1: API Key Management
EXA_API_KEY=your-api-key-here
.env
.env.local
.env.*.local
import Exa from "exa-js";
function createSecureClient(): Exa {
const apiKey = process.env.EXA_API_KEY;
if (!apiKey) {
throw new Error("EXA_API_KEY not configured");
}
if (apiKey.startsWith("sk_") && apiKey.length < 20) {
throw new Error("EXA_API_KEY appears malformed");
}
return new Exa(apiKey);
}
Step 2: Enable Content Moderation
const exa = new Exa(process.env.EXA_API_KEY);
const results = await exa.searchAndContents(
"user-provided search query",
{
numResults: 10,
text: true,
moderation: true,
}
);
Step 3: Domain Filtering for Safety
const TRUSTED_DOMAINS = [
"docs.python.org", "developer.mozilla.org", "nodejs.org",
"github.com", "stackoverflow.com", "arxiv.org",
];
const BLOCKED_DOMAINS = [
"known-malware-site.com", "phishing-domain.net",
];
async function safeDomainSearch(query: string) {
return exa.searchAndContents(query, {
numResults: 10,
includeDomains: TRUSTED_DOMAINS,
text: { maxCharacters: 1000 },
});
}
async function searchWithBlocklist(query: string) {
return exa.searchAndContents(query, {
numResults: 10,
excludeDomains: BLOCKED_DOMAINS,
text: { maxCharacters: 1000 },
});
}
Step 4: Query Sanitization
function sanitizeQuery(input: string): string {
let clean = input
.replace(/[<>{}]/g, "")
.replace(/\0/g, "")
.trim()
.substring(0, 500);
if (!clean || clean.length < 2) {
throw new Error("Query too short or empty after sanitization");
}
return clean;
}
const userQuery = sanitizeQuery(req.body.query);
const results = await exa.search(userQuery, {
numResults: 10,
moderation: true,
});
Step 5: Per-Environment Key Isolation
const KEY_MAP: Record<string, string> = {
development: process.env.EXA_API_KEY_DEV!,
staging: process.env.EXA_API_KEY_STAGING!,
production: process.env.EXA_API_KEY_PROD!,
};
function getExaForEnv(): Exa {
const env = process.env.NODE_ENV || "development";
const key = KEY_MAP[env];
if (!key) throw new Error(`No EXA key for ${env}`);
return new Exa(key);
}
Security Checklist
Error Handling
| Security Issue | Detection | Mitigation |
|---|
| Exposed API key | git log -p search | Rotate key immediately at dashboard.exa.ai |
| Unsafe search results | User reports | Enable moderation: true |
| Untrusted domains | Review result URLs | Apply includeDomains filter |
| Query injection | Input validation | Sanitize before search |
Examples
Scan Git History for Leaked Keys
set -euo pipefail
git log -p --all -S "EXA_API_KEY" -- "*.ts" "*.js" "*.py" "*.env" | head -20
Key Rotation Procedure
set -euo pipefail
export EXA_API_KEY="new-key-here"
curl -s -o /dev/null -w "%{http_code}" \
-X POST https://api.exa.ai/search \
-H "x-api-key: $EXA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query":"test","numResults":1}'
Resources
Next Steps
For production deployment, see exa-prod-checklist.
