assemblyai-security-basics

# AssemblyAI Security Basics ## Overview Security best practices for AssemblyAI: API key management, temporary tokens for browser clients, PII redaction, and data retention policies. ## Prerequisites - `assemblyai` package installed - Understanding of environment variables - AssemblyAI dashboard access ## Instructions ### Step 1: API Key Management ```bash # .env (NEVER commit) ASSEMBLYAI_API_KEY=your-api-key-here # .gitignore .env .env.local .env.*.local ``` ```typescript // Never hardcode API keys // BAD: const client = new AssemblyAI({ apiKey: 'sk_abc123...' }); // GOOD: import { AssemblyAI } from 'assemblyai'; const client = new AssemblyAI({ apiKey: process.env.ASSEMBLYAI_API_KEY!, }); ``` ### Step 2: Temporary Tokens for Browser Streaming Never expose your API key in frontend code. Use temporary tokens for browser-side streaming: ```typescript // Server-side: /api/assemblyai-token.ts import { AssemblyAI } from 'assemblyai'; const client = new AssemblyAI({ apiKey: process.env.ASSEMBLYAI_API_KEY!, }); export async function GET() { // Token expires after 5 minutes const token = await client.streaming.createTemporaryToken({ expires_in_seconds: 300, }); return Response.json({ token }); } // Client-side: use the temporary token // const { token } = await fetch('/api/assemblyai-token').then(r => r.json()); // const transcriber = new StreamingTranscriber({ token }); ``` ### Step 3: PII Redaction in Transcripts ```typescript const transcript = awa...