cohere-security-basics

# Cohere Security Basics ## Overview Security best practices for Cohere API keys, request validation, and data protection. Cohere uses bearer token auth with trial and production key tiers. ## Prerequisites - Cohere account at [dashboard.cohere.com](https://dashboard.cohere.com) - Understanding of environment variables - Secret management solution for production ## Instructions ### Step 1: API Key Management ```bash # NEVER hardcode keys — use environment variables export CO_API_KEY="your-key-here" # .env file (MUST be git-ignored) CO_API_KEY=your-key-here # .gitignore (mandatory entries) .env .env.local .env.*.local ``` **Key types:** - **Trial keys** — free, rate-limited, for development only - **Production keys** — metered billing, for live applications ### Step 2: Runtime Validation ```typescript import { CohereClientV2 } from 'cohere-ai'; function createSecureClient(): CohereClientV2 { const apiKey = process.env.CO_API_KEY; if (!apiKey) { throw new Error('CO_API_KEY is required. Set it as an environment variable.'); } // Basic key format check if (apiKey.length < 20) { throw new Error('CO_API_KEY appears malformed. Check dashboard.cohere.com.'); } return new CohereClientV2({ token: apiKey }); } ``` ### Step 3: Key Rotation Procedure ```bash # 1. Generate new key in Cohere dashboard # → dashboard.cohere.com → API Keys → Create new key # 2. Deploy new key (keep old key active) # Vercel: vercel env add CO_API_KEY production # AWS: ...