| name | apify-security-basics |
| description | Secure Apify API tokens, configure proxy access, and protect Actor data.
Use when hardening API key management, setting up environment-specific tokens,
rotating a leaked token, or auditing Apify security configuration.
Trigger with "apify security", "apify secrets", "secure apify token",
"apify API key security", "rotate apify token".
|
| allowed-tools | Read, Write, Edit, Grep |
| version | 1.5.0 |
| license | MIT |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| tags | ["saas","scraping","automation","apify"] |
| compatibility | Designed for Claude Code |
Apify Security Basics
Overview
Security best practices for Apify API tokens, Actor data, proxy credentials, and webhook verification. Apify uses personal API tokens (prefixed apify_api_) for all authentication. Because a single token grants full account access with no per-token scoping, token hygiene is the whole game.
Prerequisites
- Apify account with Console access
- Understanding of environment variables
- Access to your deployment platform's secrets management
Token Architecture
Apify uses a single API token per user account for full API access. There is no scope-based permission system per token, so token security is critical.
| Token Type | Format | Where to Find |
|---|
| Personal API token | apify_api_... | Console > Settings > Integrations |
| Proxy password | Alphanumeric | Console > Proxy > Connection settings |
Instructions
Follow the six hardening steps in order. Each has a lean summary below; the full
copy-paste code for every step is in
references/implementation.md.
-
Secure token storage — keep the token in .env (never hardcoded) and add
.env, .env.*.local, and storage/ to .gitignore. Validate presence at
startup so the app fails fast:
function requireToken(): string {
const token = process.env.APIFY_TOKEN;
if (!token) throw new Error('APIFY_TOKEN is required');
if (!token.startsWith('apify_api_')) console.warn('unexpected token prefix');
token;
}
