apify-security-basics

# Apify Security Basics ## Overview Security best practices for Apify API tokens, Actor data, proxy credentials, and webhook verification. Apify uses personal API tokens (prefixed `apify_api_`) for all authentication. ## Prerequisites - Apify account with Console access - Understanding of environment variables - Access to your deployment platform's secrets management ## Token Architecture Apify uses a single API token per user account for full API access. There is no scope-based permission system per token, so token security is critical. | Token Type | Format | Where to Find | |------------|--------|---------------| | Personal API token | `apify_api_...` | Console > Settings > Integrations | | Proxy password | Alphanumeric | Console > Proxy > Connection settings | ## Instructions ### Step 1: Secure Token Storage ```bash # .env (NEVER commit — must be in .gitignore) APIFY_TOKEN=apify_api_YOUR_TOKEN_HERE # .gitignore — mandatory entries .env .env.local .env.*.local storage/ # Local Apify storage may contain scraped data ``` ```typescript // Validate token exists at startup function requireToken(): string { const token = process.env.APIFY_TOKEN; if (!token) { throw new Error( 'APIFY_TOKEN is required. Get yours at ' + 'https://console.apify.com/account/integrations' ); } if (!token.startsWith('apify_api_')) { console.warn('Warning: APIFY_TOKEN does not have expected prefix'); } return token; } ``` ### Step 2: Per-Environment Tok...