Agent skill · security · jeremylongshore
clay-security-basics
Apply Clay security best practices for API keys, webhook secrets, and
Why this skill is useful
Provides specific procedures and scripts for securing API keys and webhook authentication in Clay, which are not commonly found in public documentation.
What it needs
Requires clay account access. About 4k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Clay Security Basics Overview Security best practices for Clay integrations covering API key management, webhook endpoint security, provider credential isolation, and lead data protection. Clay handles sensitive PII (emails, phone numbers, LinkedIn profiles) at scale, making security critical. Prerequisites Clay account with admin access Understanding of environment variables and secrets management Access to deployment platform's secrets manager Instructions Step 1: Secure API Key Storage For production, use your platform's secrets manager: Step 2: Authenticate Incoming Webhook Callbacks When Clay's HTTP API columns call your endpoint, validate the request origin: Step 3: Isolate Provider API Keys Connect provider keys directly in Clay (Settings > Connections) rather than passing them through your application. This keeps provider credentials out of your codebase: Provider Where to Store Key Why ---------- ------------------- ----- Apollo Clay Settings > Connections 0 credits when using own key Clearbit Clay Settings > Connections 0 credits when using own key Hunter.io Clay Settings > Connections 0 credits when using own key HubSpot Clay Settings > Connections CRM sync uses Clay's OAuth Salesforce Clay Settings > Connections CRM sync uses Clay's OAuth Step 4: API Key Rotation Procedure Step 5: Protect Enriched Lead Data Step 6: Security Checklist [ ] API keys stored in environment variables or secrets manager [ ] .env files in .gitignore [ ] Webhook callback endpoints validate request signatures [ ] Provider API keys connected in Clay UI (not in application code) [ ] API key rotation procedure documented and tested [ ] Enriched PII data redacted in application logs [ ] Clay workspace uses separate API keys per integration [ ] Least privilege: viewers can't run enrichments or export data [ ] No hardcoded Clay URLs or keys in source code [ ] git-secrets or similar scanning enabled in CI Error Handling Security Issue Detection Mitigation ---------------- ----------- --- …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/clay-security-basics