firecrawl-security-basics

# Firecrawl Security Basics ## Overview Security best practices for Firecrawl API keys, webhook signature verification, and scraped content handling. Firecrawl API keys start with `fc-` and grant full access to scrape, crawl, map, and extract endpoints — protecting them is critical. ## Prerequisites - Firecrawl API key - Understanding of environment variables - Webhook endpoint (if using async crawl callbacks) ## Instructions ### Step 1: Secure API Key Storage ```bash # .env (NEVER commit to git) FIRECRAWL_API_KEY=fc-your-api-key-here # .gitignore — add these patterns echo -e "\n.env\n.env.local\n.env.*.local" >> .gitignore ``` ```typescript // Validate key exists before creating client import FirecrawlApp from "@mendable/firecrawl-js"; if (!process.env.FIRECRAWL_API_KEY?.startsWith("fc-")) { throw new Error("FIRECRAWL_API_KEY must be set and start with 'fc-'"); } const firecrawl = new FirecrawlApp({ apiKey: process.env.FIRECRAWL_API_KEY, }); ``` ### Step 2: Verify Webhook Signatures Firecrawl signs webhook payloads with HMAC-SHA256 via the `X-Firecrawl-Signature` header. ```typescript import crypto from "crypto"; function verifyWebhookSignature( payload: string, signature: string, secret: string ): boolean { const expected = crypto .createHmac("sha256", secret) .update(payload) .digest("hex"); // Timing-safe comparison prevents timing attacks return crypto.timingSafeEqual( Buffer.from(signature), Buffer.from(expected) ); } /...