Agent skill · security · jeremylongshore
apify-security-basics
Secure Apify API tokens, configure proxy access, and protect Actor data. Use when hardening API key management, setting up environment-specific tokens, rotating a leaked token, or auditing Apify security configuration. Trigger with "apify security", "apify secrets", "secure apify token", "apify API key security", "rotate apify token".
Why this skill is useful
Provides specific security practices and code snippets for managing Apify API tokens and Actor data that the AI wouldn't reliably generate on its own.
What it needs
Requires apify account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Apify Security Basics Overview Security best practices for Apify API tokens, Actor data, proxy credentials, and webhook verification. Apify uses personal API tokens (prefixed apifyapi) for all authentication. Because a single token grants full account access with no per-token scoping, token hygiene is the whole game. Prerequisites Apify account with Console access Understanding of environment variables Access to your deployment platform's secrets management Token Architecture Apify uses a single API token per user account for full API access. There is no scope-based permission system per token, so token security is critical. Token Type Format Where to Find ------------ -------- --------------- Personal API token apifyapi... Console > Settings > Integrations Proxy password Alphanumeric Console > Proxy > Connection settings Instructions Follow the six hardening steps in order. Each has a lean summary below; the full copy-paste code for every step is in references/implementation.md. 1. Secure token storage — keep the token in .env (never hardcoded) and add .env, .env..local, and storage/ to .gitignore. Validate presence at startup so the app fails fast: 2. Per-environment token isolation — separate tokens (ideally separate accounts) for dev / staging / prod, injected via each platform's secret store (gh secret set, vercel env add, GCP Secret Manager). 3. Token rotation — generate the new token first (old stays valid), push to every environment, verify it authenticates, then revoke the old one. 4. Webhook payload verification — Apify does not sign webhooks; confirm the run ID in the payload actually exists, or gate on a shared URL secret compared with crypto.timingSafeEqual. 5. Actor data security — redact sensitive fields before pushData; keep datasets named and private (no public sharing). 6. Proxy security — never log proxyConfig.newUrl() (it embeds the proxy password); log the proxy group only. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/apify-security-basics