elevenlabs-security-basics

# ElevenLabs Security Basics ## Overview Security best practices for ElevenLabs API key management, webhook HMAC signature verification, and protecting cloned voice data. ElevenLabs uses a single API key (`xi-api-key`) and HMAC webhook authentication. ## Prerequisites - ElevenLabs SDK installed - Understanding of environment variables - Access to ElevenLabs dashboard (Settings > API Keys) ## Instructions ### Step 1: API Key Management ```bash # .env (NEVER commit to git) ELEVENLABS_API_KEY=sk_your_key_here # .gitignore — MUST include these .env .env.local .env.*.local ``` **Git pre-commit hook** to prevent accidental key commits: ```bash #!/bin/bash # .git/hooks/pre-commit if git diff --cached | grep -qE 'sk_[a-zA-Z0-9]{20,}'; then echo "ERROR: ElevenLabs API key detected in staged changes!" echo "Remove the key and use environment variables instead." exit 1 fi ``` ### Step 2: Environment-Specific Keys ```typescript // src/elevenlabs/config.ts interface ElevenLabsSecurityConfig { apiKey: string; webhookSecret: string; environment: "development" | "staging" | "production"; } export function getSecurityConfig(): ElevenLabsSecurityConfig { const env = (process.env.NODE_ENV || "development") as ElevenLabsSecurityConfig["environment"]; const apiKey = process.env.ELEVENLABS_API_KEY; if (!apiKey) { throw new Error("ELEVENLABS_API_KEY is required"); } // Warn if production key is used in dev if (env === "development" && apiKey.startsWith("sk_...