Cohere Security Basics
Overview
Security best practices for Cohere API keys, request validation, and data protection. Cohere uses bearer token auth with trial and production key tiers.
Prerequisites
- Cohere account at dashboard.cohere.com
- Understanding of environment variables
- Secret management solution for production
Instructions
Step 1: API Key Management
export CO_API_KEY="your-key-here"
CO_API_KEY=your-key-here
.env
.env.local
.env.*.local
Key types:
- Trial keys — free, rate-limited, for development only
- Production keys — metered billing, for live applications
Step 2: Runtime Validation
import { CohereClientV2 } from 'cohere-ai';
function createSecureClient(): CohereClientV2 {
const apiKey = process.env.CO_API_KEY;
if (!apiKey) {
throw new Error('CO_API_KEY is required. Set it as an environment variable.');
}
if (apiKey.length < 20) {
throw new Error('CO_API_KEY appears malformed. Check dashboard.cohere.com.');
}
return new CohereClientV2({ token: apiKey });
}
Step 3: Key Rotation Procedure
vercel env add CO_API_KEY production
aws secretsmanager update-secret --secret-id cohere/api-key --secret-string "new-key"
echo -n "new-key" | gcloud secrets versions add cohere-api-key --data-file=-
curl -s -o /dev/null -w "%{http_code}" \
-H "Authorization: Bearer NEW_KEY" \
-H "Content-Type: application/json" \
https://api.cohere.com/v2/chat \
-d '{"model":"command-r7b-12-2024","messages":[{"role":"user","content":"test"}]}'
Step 4: Request Data Protection
const PII_PATTERNS: [string, RegExp][] = [
['email', /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g],
['phone', /\b\d{3}[-.]?\d{3}[-.]?\d{4}\b/g],
['ssn', /\b\d{3}-\d{2}-\d{4}\b/g],
];
function scrubPII(text: string): string {
let scrubbed = text;
for (const [type, regex] of PII_PATTERNS) {
scrubbed = scrubbed.replace(regex, `[REDACTED_${type.toUpperCase()}]`);
}
return scrubbed;
}
async function safeCohereChat(userInput: string) {
const sanitized = scrubPII(userInput);
return cohere.chat({
model: 'command-a-03-2025',
messages: [{ role: 'user', content: sanitized }],
safetyMode: 'CONTEXTUAL',
});
}
Step 5: Logging Safety
import { CohereError } from 'cohere-ai';
function safeLog(message: string, data?: Record<string, unknown>) {
const sanitized = { ...data };
delete sanitized.apiKey;
delete sanitized.token;
delete sanitized.authorization;
if (typeof sanitized.body === 'string' && (sanitized.body as string).length > 500) {
sanitized.body = (sanitized.body as string).slice(0, 500) + '...[truncated]';
}
console.log(`[cohere] ${message}`, sanitized);
}
function logCohereError(err: unknown) {
if (err instanceof CohereError) {
(, {
: err.,
: err.,
});
}
}
Step 6: Safety Modes
Cohere's Chat API supports safety modes that control content filtering:
await cohere.chat({
model: 'command-a-03-2025',
messages: [{ role: 'user', content: prompt }],
safetyMode: 'CONTEXTUAL',
});
await cohere.chat({
model: 'command-a-03-2025',
messages: [{ role: 'user', content: prompt }],
safetyMode: 'STRICT',
});
Security Checklist
Git Pre-Commit Hook
#!/bin/bash
if git diff --cached --diff-filter=ACM | grep -qiE 'CO_API_KEY|cohere.*key.*=.*[a-zA-Z0-9]{20}'; then
echo "ERROR: Possible Cohere API key in commit. Remove before committing."
exit 1
fi
Error Handling
| Security Issue | Detection | Mitigation |
|---|
| Key in git history | git log -p | grep CO_API_KEY | Rotate key immediately |
| Key in logs | Log audit | Add log scrubbing |
| Key in error report | Error handler review | Sanitize error payloads |
| Excessive token spend | Billing dashboard | Set budget alerts |
Resources
Next Steps
For production deployment, see cohere-prod-checklist.
