fathom-security-basics

# Fathom Security Basics ## Overview Fathom records and transcribes meetings, producing transcripts and action items that contain participant PII (names, emails, spoken content), confidential business decisions, and potentially sensitive negotiations. API keys are per-user and grant access to all meetings the user recorded or that were shared to their team. Protect recording consent workflows, transcript storage, and any analytics pipeline touching meeting content. ## API Key Management ```typescript function createFathomClient(): { apiKey: string; baseUrl: string } { const apiKey = process.env.FATHOM_API_KEY; if (!apiKey) { throw new Error("Missing FATHOM_API_KEY — store in secrets manager, never in code"); } // Fathom keys are per-user — never share across team members console.log("Fathom client initialized (key hash:", apiKey.slice(-4), ")"); return { apiKey, baseUrl: "https://api.fathom.video/v1" }; } ``` ## Webhook Signature Verification ```typescript import crypto from "crypto"; import { Request, Response, NextFunction } from "express"; function verifyFathomWebhook(req: Request, res: Response, next: NextFunction): void { const signature = req.headers["x-fathom-signature"] as string; const secret = process.env.FATHOM_WEBHOOK_SECRET!; const expected = crypto.createHmac("sha256", secret).update(req.body).digest("hex"); if (!signature || !crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) { res.status(401).send("Invalid si...