gamma-security-basics

# Gamma Security Basics ## Overview Security best practices for Gamma API integration to protect credentials and data. ## Prerequisites - Active Gamma integration - Environment variable support - Understanding of secret management ## Instructions ### Step 1: Secure API Key Storage ```typescript // NEVER do this const gamma = new GammaClient({ apiKey: 'gamma_live_abc123...', // Hardcoded - BAD! }); // DO this instead const gamma = new GammaClient({ apiKey: process.env.GAMMA_API_KEY, }); ``` **Environment Setup:** ```bash # .env (add to .gitignore!) GAMMA_API_KEY=gamma_live_abc123... # Load in application import 'dotenv/config'; ``` ### Step 2: Key Rotation Strategy ```typescript // Support multiple keys for rotation const gamma = new GammaClient({ apiKey: process.env.GAMMA_API_KEY_PRIMARY || process.env.GAMMA_API_KEY_SECONDARY, }); // Rotation script async function rotateApiKey() { // 1. Generate new key in Gamma dashboard // 2. Update GAMMA_API_KEY_SECONDARY // 3. Deploy and verify // 4. Swap PRIMARY and SECONDARY // 5. Revoke old key } ``` ### Step 3: Request Signing (if supported) ```typescript import crypto from 'crypto'; function signRequest(payload: object, secret: string): string { const timestamp = Date.now().toString(); const message = timestamp + JSON.stringify(payload); return crypto .createHmac('sha256', secret) .update(message) .digest('hex'); } // Usage with webhook verification function verifyWebhook(body: strin...