apollo-security-basics

# Apollo Security Basics ## Overview Security best practices for Apollo.io API integrations. Apollo API keys grant broad access to 275M+ contacts — a leaked key is a serious incident. This covers key management, PII redaction, data access controls, key rotation, and audit procedures. ## Prerequisites - Valid Apollo.io API credentials - Node.js 18+ ## Instructions ### Step 1: Secure API Key Storage Apollo supports two key types with different risk profiles: - **Standard key**: search + enrichment only (lower risk) - **Master key**: full CRM access including delete (highest risk) ```typescript // NEVER: const API_KEY = 'abc123'; // hardcoded // NEVER: params: { api_key: key } // query string (logged in server access logs) // ALWAYS: x-api-key header + env var or secret manager import { SecretManagerServiceClient } from '@google-cloud/secret-manager'; async function getApiKey(): Promise<string> { // Dev/staging: environment variable if (process.env.APOLLO_API_KEY) return process.env.APOLLO_API_KEY; // Production: GCP Secret Manager const client = new SecretManagerServiceClient(); const [version] = await client.accessSecretVersion({ name: 'projects/my-project/secrets/apollo-api-key/versions/latest', }); return version.payload?.data?.toString() ?? ''; } ``` ```bash # .gitignore — prevent accidental commits .env .env.local .env.*.local *.pem secrets/ ``` ### Step 2: PII Redaction for Logging Apollo responses contain emails, phone numbers, and LinkedIn...