documenso-security-basics

# Documenso Security Basics ## Overview Essential security practices for Documenso integrations: API key management, webhook verification, document access control, and self-hosted signing certificate configuration. ## Prerequisites - Documenso account with API access - Understanding of environment variables and secret management - Completed `documenso-install-auth` setup ## Instructions ### Step 1: API Key Security ```typescript // NEVER hardcode keys const BAD = new Documenso({ apiKey: "api_abc123..." }); // Exposed in source // ALWAYS use environment variables const GOOD = new Documenso({ apiKey: process.env.DOCUMENSO_API_KEY! }); ``` **Key management rules:** - Store in `.env` (never committed) or a secrets manager (Vault, AWS Secrets Manager) - Use team-scoped keys for team resources, personal keys for personal documents - Rotate keys on employee offboarding -- revoke in dashboard immediately - CI/CD: use masked/encrypted secrets (GitHub Secrets, GitLab CI variables) ```bash # .gitignore — always include .env .env.* !.env.example ``` ### Step 2: Key Rotation with Zero Downtime ```typescript // Support dual keys during rotation function getApiKey(): string { // Try primary first, fall back to secondary during rotation return process.env.DOCUMENSO_API_KEY_PRIMARY ?? process.env.DOCUMENSO_API_KEY_SECONDARY ?? (() => { throw new Error("No Documenso API key configured"); })(); } // Rotation procedure: // 1. Generate new key in Documenso dashboard // 2....