Agent skill · security · jeremylongshore
elevenlabs-security-basics
Apply ElevenLabs security best practices for API keys, webhook HMAC validation, and voice data protection. Use when securing API keys, validating webhook signatures, or auditing ElevenLabs security configuration. Trigger with "elevenlabs security", "elevenlabs secrets", "secure elevenlabs", "elevenlabs API key security", "elevenlabs webhook signature", "elevenlabs HMAC".
Why this skill is useful
Provides specific procedures and scripts for securing ElevenLabs API keys and webhooks that the AI wouldn't reliably generate on its own.
What it needs
Requires elevenlabs-sdk installed locally. Requires elevenlabs account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
ElevenLabs Security Basics Overview Security best practices for ElevenLabs API key management, webhook HMAC signature verification, and protecting cloned voice data. ElevenLabs uses a single API key (xi-api-key) and HMAC webhook authentication. This SKILL.md carries the workflow at a high level with the essential skeletons. Full production code for each step lives in references/implementation.md, and end-to-end scenarios live in references/examples.md. Prerequisites ElevenLabs SDK installed Understanding of environment variables Access to ElevenLabs dashboard (Settings > API Keys) Instructions Step 1: API Key Management Keep keys out of source, and add a hook that blocks accidental commits: Step 2: Environment-Specific Keys Load the key at startup, fail fast when it is missing, and warn if a production key leaks into development. Full getSecurityConfig() implementation: references/implementation.md. Step 3: Webhook HMAC Signature Verification ElevenLabs webhooks carry an ElevenLabs-Signature header formatted as t=TIMESTAMP,v1=SIGNATURE. Verify it with HMAC-SHA256, reject timestamps older than 5 minutes (replay protection), and use a timing-safe comparison. Full verifyWebhookSignature() implementation: references/implementation.md. Step 4: Express Webhook Endpoint with Verification Verify against the raw request body, respond 200 fast, then process asynchronously so you never trip the webhook timeout. Full endpoint: references/implementation.md. Step 5: API Key Rotation Procedure Generate the new key, validate it before cutover, push to every environment, verify production, then revoke the old key — zero downtime. Full runbook: references/implementation.md. Step 6: Voice Data Protection Cloned voices are biometric PII: restrict who can clone, audit-log every operation, and require documented consent. Full policy and audit logger: references/implementation.md. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/elevenlabs-security-basics