Apply Clay security best practices for secrets and access control. Use when securing API keys, implementing least privilege access, or auditing Clay security configuration. Trigger with phrases like "clay security", "clay secrets", "secure clay", "clay API key security".
npxskills add jeremylongshore/claude-code-plugins-plus-skills--skill clay-security-basicsLoading…
Security best practices for Clay integrations covering API key management, webhook endpoint security, provider credential isolation, and lead data protection. Clay handles sensitive PII (emails, phone numbers, LinkedIn profiles) at scale, making security critical.
# .env (NEVER commit to git)
CLAY_API_KEY=clay_ent_your_api_key_here
CLAY_WEBHOOK_URL=https://app.clay.com/api/v1/webhooks/your-id
# .gitignore — add these patterns
.env
.env.local
.env.*.local
*.key
For production, use your platform's secrets manager:
# GitHub Actions
gh secret set CLAY_API_KEY --body "clay_ent_your_key"
# Google Cloud Secret Manager
echo -n "clay_ent_your_key" | gcloud secrets create clay-api-key --data-file=-
# AWS Secrets Manager
aws secretsmanager create-secret \
--name clay/api-key \
--secret-string "clay_ent_your_key"
When Clay's HTTP API columns call your endpoint, validate the request origin:
// src/middleware/clay-auth.ts
import crypto from 'crypto';
const CLAY_WEBHOOK_SECRET = process.env.CLAY_WEBHOOK_SECRET!;
function verifyClayCallback(
payload: string,
signature: string | undefined
): boolean {
if (!signature || !CLAY_WEBHOOK_SECRET) return false;
const expected = crypto
.createHmac('sha256', CLAY_WEBHOOK_SECRET)
.update(payload)
.digest('hex');
return crypto.timingSafeEqual(
Buffer.from(signature, 'hex'),
Buffer.from(expected, 'hex')
);
}
// Express middleware
function clayAuthMiddleware(req: any, res: any, next: any) {
const signature = req.headers['x-clay-signature'] as string;
const rawBody = JSON.stringify(req.body);
if (!verifyClayCallback(rawBody, signature)) {
console.warn('Rejected unauthorized Clay callback from', req.ip);
return res.status(401).json({ error: 'Invalid signature' });
}
next();
}
Connect provider keys directly in Clay (Settings > Connections) rather than passing them through your application. This keeps provider credentials out of your codebase:
| Provider | Where to Store Key | Why |
|---|---|---|
| Apollo | Clay Settings > Connections | 0 credits when using own key |
| Clearbit | Clay Settings > Connections | 0 credits when using own key |
| Hunter.io | Clay Settings > Connections | 0 credits when using own key |
| HubSpot | Clay Settings > Connections | CRM sync uses Clay's OAuth |
| Salesforce | Clay Settings > Connections | CRM sync uses Clay's OAuth |
# 1. Generate new key in Clay Settings > API
# 2. Update all integrations with new key
# 3. Test connectivity
curl -s -X POST "https://api.clay.com/v1/people/enrich" \
-H "Authorization: Bearer $NEW_CLAY_API_KEY" \
-H "Content-Type: application/json" \
-d '{"email": "[email protected]"}' | jq .status
# 4. Once confirmed working, revoke old key in Clay dashboard
# 5. Update deployment secrets
gh secret set CLAY_API_KEY --body "$NEW_CLAY_API_KEY"
// src/clay/data-protection.ts
const PII_FIELDS = ['email', 'phone', 'personal_email', 'home_address', 'linkedin_url'];
/** Strip PII from enriched data before logging or analytics */
function redactPII(row: Record<string, unknown>): Record<string, unknown> {
const redacted = { ...row };
for (const field of PII_FIELDS) {
if (field in redacted) {
redacted[field] = '[REDACTED]';
}
}
return redacted;
}
/** Hash email for deduplication without storing plaintext */
function hashEmail(email: string): string {
return crypto.createHash('sha256').update(email.toLowerCase().trim()).digest('hex');
}
// Usage: log enriched data safely
console.log('Enriched:', redactPII(enrichedRow));
.env files in .gitignore| Security Issue | Detection | Mitigation |
|---|---|---|
| API key in git history | git log -p --all -S 'clay_ent_' | Rotate key immediately, use BFG to scrub |
| Unauthorized webhook calls | Missing signature validation | Add HMAC verification middleware |
| Over-permissioned users | Viewers running enrichments | Audit roles in Settings > Members |
| PII in application logs | grep logs for email patterns | Add PII redaction to log pipeline |
For production deployment, see clay-prod-checklist.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).