Skip to main content
apollo-security-basics Apply Apollo.io API security best practices.
Use when securing Apollo integrations, managing API keys,
or implementing secure data handling.
Trigger with phrases like "apollo security", "secure apollo api",
"apollo api key security", "apollo data protection".
설치로 이동 Skills Marketplace 커뮤니티가 만든 AI 스킬을 발견하고 탐색하세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/jeremylongshore/claude-code-plugins-plus-skills --skill apollo-security-basics명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
Zip 다운로드 다운로드 중... 이 저장소의 다른 Skills Implement user sign-up and sign-in flows with Clerk.
Use when building authentication UI, customizing sign-in experience,
or implementing OAuth social login.
Trigger with phrases like "clerk sign-in", "clerk sign-up",
"clerk login flow", "clerk OAuth", "clerk social login".
Implement session management and middleware with Clerk.
Use when managing user sessions, configuring route protection,
or implementing token refresh and custom JWT templates.
Trigger with phrases like "clerk session", "clerk middleware",
"clerk route protection", "clerk token", "clerk JWT".
Configure enterprise SSO, role-based access control, and organization management.
Use when implementing SSO integration, configuring role-based permissions,
or setting up organization-level controls.
Trigger with phrases like "clerk SSO", "clerk RBAC",
"clerk enterprise", "clerk roles", "clerk permissions", "clerk organizations".
jeremylongshore
jeremylongshore/claude-code-plugins-plus-skills
GitHub 저장소 열기 name apollo-security-basics description Apply Apollo.io API security best practices.
Use when securing Apollo integrations, managing API keys,
or implementing secure data handling.
Trigger with phrases like "apollo security", "secure apollo api",
"apollo api key security", "apollo data protection".
allowed-tools Read, Grep, Bash(curl:*) version 1.13.0 license MIT author Jeremy Longshore <jeremy@intentsolutions.io> tags ["saas","apollo","api","security"] compatibility Designed for Claude Code, also compatible with Codex and OpenClaw
Apollo Security Basics
Overview
Security best practices for Apollo.io API integrations. Apollo API keys grant broad access to 275M+ contacts — a leaked key is a serious incident. This covers key management, PII redaction, data access controls, key rotation, and audit procedures.
Prerequisites
Valid Apollo.io API credentials
Node.js 18+
Instructions
Step 1: Secure API Key Storage
Apollo supports two key types with different risk profiles:
Standard key : search + enrichment only (lower risk)Master key : full CRM access including delete (highest risk)
import { SecretManagerServiceClient } from '@google-cloud/secret-manager' ;
async function getApiKey (Promise <string > {
if (process.env .APOLLO_API_KEY ) return process.env .APOLLO_API_KEY ;
const client = new SecretManagerServiceClient ();
const [version] = await client.accessSecretVersion ({
name : 'projects/my-project/secrets/apollo-api-key/versions/latest' ,
});
return version.payload ?.data ?.toString () ?? ''
.env
.env.local
.env .*.local
*.pem
secrets/
Step 2: PII Redaction for Logging Apollo responses contain emails, phone numbers, and LinkedIn profiles. Never log raw responses in production.
const PII_PATTERNS : [RegExp , string ][] = [
[/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z]{2,}\b/gi , '[EMAIL]' ],
[/\b\+?\d{1,3}[-.\s]?\(?\d{1,4}\)?[-.\s]?\d{1,4}[-.\s]?\d{1,9}\b/g , '[PHONE]' ],
[/x-api-key[:\s]+["']?[\w-]+["']?/gi , 'x-api-key: [REDACTED]' ],
[/linkedin\.com\/in\/[^\s"',]+/gi , 'linkedin.com/in/[REDACTED]' ],
];
export function redactPII (text : string string {
let result = text;
for (const [pattern, replacement] of PII_PATTERNS ) {
result = result.replace (pattern, replacement);
}
return result;
}
client.interceptors .response .use ((response ) => {
if (process.env .NODE_ENV === 'production' ) {
console .log (`[Apollo] ${response.status} ${response.config.url} ` );
} else {
console .log ('[Apollo]' , redactPII (JSON .stringify (response.data ).slice (0 , 500 )));
}
return response;
});
Step 3: Use Minimal Key Permissions
export function createReadOnlyClient (return axios.create ({
baseURL : 'https://api.apollo.io/api/v1' ,
headers : {
'Content-Type' : 'application/json' ,
'x-api-key' : process.env .APOLLO_STANDARD_KEY !,
},
});
}
export function createFullAccessClient (return axios.create ({
baseURL : 'https://api.apollo.io/api/v1' ,
headers : {
'Content-Type' : 'application/json' ,
'x-api-key' : process.env .APOLLO_MASTER_KEY !,
},
});
}
Step 4: API Key Rotation Procedure async function rotateApiKey (const newKey = process.env .APOLLO_API_KEY_NEW ;
const oldKey = process.env .APOLLO_API_KEY ;
try {
const resp = await axios.get ('https://api.apollo.io/api/v1/auth/health' , {
headers : { 'x-api-key' : newKey! },
});
if (!resp.data .is_logged_in ) throw new Error ('New key failed auth check' );
console .log ('New API key verified' );
} catch {
console .error ('New API key invalid — aborting rotation' );
return ;
}
console .log ('Rotation steps: update secrets -> deploy -> revoke old key in dashboard' );
}
Step 5: Security Audit Script async function runSecurityAudit (const checks : Array <{ name : string ; pass : boolean ; detail : string }> = [];
const { execSync } = await import ('child_process' );
try {
execSync ('grep -rn "x-api-key.*[a-zA-Z0-9]\\{20,\\}" src/ --include="*.ts"' , { stdio : 'pipe' });
checks.push ({ name : 'No hardcoded keys' , pass : false , detail : 'Hardcoded key found in source!' });
} catch {
checks.push ({ name : 'No hardcoded keys' , pass : true , detail : 'OK' });
}
checks.push ({
name : 'HTTPS only' ,
pass : !process.env .APOLLO_BASE_URL || process.env .APOLLO_BASE_URL .startsWith ('https://' ),
detail : 'Base URL uses HTTPS' ,
});
const gitCheck = execSync ('git check-ignore .env 2>/dev/null || echo NOT' ).toString ().trim ();
checks.push ({ name : '.env gitignored' , pass : gitCheck !== 'NOT' , detail : gitCheck !== 'NOT' ? 'OK' : 'ADD .env to .gitignore' });
try {
execSync ('grep -rn "api_key.*=" src/ --include="*.ts" | grep -v "x-api-key"' , { stdio : 'pipe' });
checks.push ({ name : 'Header auth only' , pass : false , detail : 'Found api_key in query params — use x-api-key header' });
} catch {
checks.push ({ name : 'Header auth only' , pass : true , detail : 'OK' });
}
for (const c of checks) console .log (`${c.pass ? 'PASS' : 'FAIL' } ${c.name} : ${c.detail} ` );
}
Output
Secure API key loading from env vars or GCP Secret Manager
PII redaction utility for emails, phones, API keys, and LinkedIn URLs
Scoped clients: read-only (standard key) vs full-access (master key)
Key rotation procedure with verification
Automated security audit checking for hardcoded keys and header auth
Error Handling Issue Mitigation API key committed to git Rotate immediately, revoke old key in Apollo dashboard PII in log files Enable redactPII interceptor, review log retention Using api_key query param Switch to x-api-key header — query params appear in server logs Master key used everywhere Split into standard + master keys, use minimal permissions
Resources
Next Steps Proceed to apollo-prod-checklist for production deployment.
