API Key Authentication for Meeting Bots: Security Best Practices

Keep keys out of your code

The first rule of API key management: never put a key directly in source code. Use environment variables in development and a secrets manager (AWS Secrets Manager, 1Password Secrets Automation, HashiCorp Vault) in production.

// Wrong
const key = "gk_live_abc123";

// Right const key = process.env.GREGNOTE_API_KEY; ```

Use separate keys per environment

Gregnote issues live keys (gk_live_) and test keys (gk_test_). Use test keys in development and staging. This prevents a bug in a non-production environment from accidentally joining real customer meetings or incurring real charges.

Rotate keys on suspected compromise

If a key is ever committed to a repository, logged to an error tracking service, or accessed by a departing employee, rotate it immediately from the dashboard. Gregnote lets you create a new key and revoke the old one without any downtime — the new key works immediately.

Always verify webhook signatures

Every Gregnote webhook is signed with HMAC-SHA256. Verifying the signature prevents an attacker from sending fake webhook payloads to your endpoint:

function verifyWebhook(rawBody, signature, secret) {
  const [tPart, vPart] = signature.split(",");
  const timestamp = tPart.split("=")[1];
  const received  = vPart.split("=")[1];

// Reject signatures older than 5 minutes if (Date.now() / 1000 - parseInt(timestamp) > 300) return false;

const expected = crypto .createHmac("sha256", secret) .update(timestamp + "." + rawBody) .digest("hex");

return crypto.timingSafeEqual( Buffer.from(received), Buffer.from(expected) ); } ```

Note timingSafeEqual — use it instead of === to prevent timing attacks.

Protect your webhook endpoint

Your webhook endpoint should return 200 immediately, do work asynchronously, and never expose stack traces in error responses. Rate-limit it to reject floods of fake requests.