deepgram-security-basics

name	deepgram-security-basics
description	Apply Deepgram security best practices for API key management and data protection. Use when securing Deepgram integrations, implementing key rotation, or auditing security configurations. Trigger: "deepgram security", "deepgram API key security", "secure deepgram", "deepgram key rotation", "deepgram data protection", "deepgram PII redaction".
allowed-tools	Read, Write, Edit, Grep, Bash(curl:*)
version	1.13.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","deepgram","api","security","compliance"]
compatibility	Designed for Claude Code

Deepgram Security Basics

Overview

Security best practices for Deepgram integration: scoped API keys, key rotation, Deepgram's built-in PII redaction feature, client-side temporary keys, SSRF prevention for audio URLs, and audit logging.

Security Checklist

• API keys in environment variables or secret manager (never in code)
• Separate keys per environment (dev/staging/prod)
• Keys scoped to minimum required permissions
• Key rotation schedule (90 days recommended)
• Deepgram redact option enabled for PII-sensitive audio
• Audio URLs validated (HTTPS only, no private IPs)
• Audit logging on all transcription operations

Instructions

Step 1: Scoped API Keys

Create keys with minimal permissions in Console > Settings > API Keys:

// Production transcription service — only needs listen scope
const sttKey = process.env.DEEPGRAM_STT_KEY;  // Scope: listen

// TTS service — only needs speak scope
const ttsKey = process.env.DEEPGRAM_TTS_KEY;  // Scope: speak

// Monitoring dashboard — only needs usage read
const monitorKey = process.env.DEEPGRAM_MONITOR_KEY;  // Scope: usage:read

// Admin operations — separate key, restricted access
const adminKey = process.env.DEEPGRAM_ADMIN_KEY;  // Scope: manage, keys

Step 2: Deepgram Built-in PII Redaction

import { createClient }  ;

 deepgram = (process..!);


 { result } =  deepgram...(
  { : audioUrl },
  {
    : ,
    : ,
    
    : [, , ],
    
    
    
  }
);


.(result..[].[].);