fireflies-security-basics

•

1.9k2643 months ago

Apply Fireflies.ai security best practices for secrets and access control. Use when securing API keys, implementing least privilege access, or auditing Fireflies.ai security configuration. Trigger with phrases like "fireflies security", "fireflies secrets", "secure fireflies", "fireflies API key security".

Quick Install

npxskills add jeremylongshore/claude-code-plugins-plus-skills--skill fireflies-security-basics

Instructions

Fireflies.ai Security Basics

Overview

Security essentials for Fireflies.ai: API key management, webhook HMAC-SHA256 signature verification, transcript access controls, and audit practices.

Prerequisites

Fireflies.ai API key
Understanding of environment variables
HTTPS endpoint for webhooks (required by Fireflies)

Instructions

Step 1: Secure API Key Storage

# .env (NEVER commit)
FIREFLIES_API_KEY=your-api-key
FIREFLIES_WEBHOOK_SECRET=your-16-to-32-char-secret

# .gitignore
.env
.env.local
.env.*.local

Pre-commit hook to catch leaked keys:

#!/bin/bash
# .git/hooks/pre-commit
if git diff --cached --name-only | xargs grep -l 'FIREFLIES_API_KEY\s*=' 2>/dev/null; then
  echo "ERROR: Potential API key in commit. Remove before committing."
  exit 1
fi

Step 2: Webhook Signature Verification (HMAC-SHA256)

Fireflies signs webhook payloads with HMAC-SHA256. The signature arrives in the x-hub-signature header.

import crypto from "crypto";

function verifyFirefliesWebhook(
  payload: string,
  signature: string,
  secret: string
): boolean {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(payload)
    .digest("hex");

  // Timing-safe comparison prevents timing attacks
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// Express middleware
import express from "express";
const app = express();

app.post("/webhooks/fireflies",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const signature = req.headers["x-hub-signature"] as string;
    const payload = req.body.toString();

    if (!signature || !verifyFirefliesWebhook(payload, signature, process.env.FIREFLIES_WEBHOOK_SECRET!)) {
      console.warn("Invalid webhook signature rejected");
      return res.status(401).json({ error: "Invalid signature" });
    }

    const event = JSON.parse(payload);
    console.log(`Verified webhook: ${event.eventType} for ${event.meetingId}`);
    res.status(200).json({ received: true });
  }
);

Loading…

Related Skills

skill-creator

Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.

367,360

skill-creator

Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.

367,309

1password

Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.

365,915

himalaya

CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).

365,885

Tags & Topics

aiautomationclaude-codedevopsmcpai-agents

Instructions

Step 1: Secure API Key Storage

# .env (NEVER commit) FIREFLIES_API_KEY=your-api-key FIREFLIES_WEBHOOK_SECRET=your-16-to-32-char-secret # .gitignore .env .env.local .env.*.local

Pre-commit hook to catch leaked keys:

#!/bin/bash # .git/hooks/pre-commit if git diff --cached --name-only | xargs grep -l 'FIREFLIES_API_KEY\s*=' 2>/dev/null; then echo "ERROR: Potential API key in commit. Remove before committing." exit 1 fi

Step 2: Webhook Signature Verification (HMAC-SHA256)

Fireflies signs webhook payloads with HMAC-SHA256. The signature arrives in the x-hub-signature header.

import crypto from "crypto"; function verifyFirefliesWebhook( payload: string, signature: string, secret: string ): boolean { const expected = crypto .createHmac("sha256", secret) .update(payload) .digest("hex"); // Timing-safe comparison prevents timing attacks return crypto.timingSafeEqual( Buffer.from(signature), Buffer.from(expected) ); } // Express middleware import express from "express"; const app = express(); app.post("/webhooks/fireflies", express.raw({ type: "application/json" }), (req, res) => { const signature = req.headers["x-hub-signature"] as string; const payload = req.body.toString(); if (!signature || !verifyFirefliesWebhook(payload, signature, process.env.FIREFLIES_WEBHOOK_SECRET!)) { console.warn("Invalid webhook signature rejected"); return res.status(401).json({ error: "Invalid signature" }); } const event = JSON.parse(payload); console.log(`Verified webhook: ${event.eventType} for ${event.meetingId}`); res.status(200).json({ received: true }); } );

Level	Access
`owner`	Only meeting organizer
`participants`	Only meeting participants
`teammatesandparticipants`	Workspace members + participants
`teammates`	All workspace members
`link`	Anyone with the link

Issue	Detection	Fix
Leaked API key	Git scanning, CI alerts	Regenerate immediately in dashboard
Invalid webhook signature	401 from your endpoint	Verify secret matches dashboard
Overly permissive privacy	Audit transcript visibility	Set to `participants` default
Key rotation gap	Auth failures after rotation	Deploy new key before revoking old

fireflies-security-basics

Fireflies.ai Security Basics

Overview

Prerequisites

Instructions

Step 1: Secure API Key Storage

Step 2: Webhook Signature Verification (HMAC-SHA256)

Related Skills

skill-creator

skill-creator

1password

himalaya

Fireflies.ai Security Basics

Overview

Prerequisites

Instructions

Step 1: Secure API Key Storage

Step 2: Webhook Signature Verification (HMAC-SHA256)

Step 3: Configure Webhook Secret

Step 4: Python Webhook Verification

Step 5: Transcript Privacy Levels

Step 6: API Key Rotation

Security Checklist

Error Handling

Output

Resources

Next Steps

Related Skills

skill-creator

skill-creator

1password

himalaya

Related Skills

skill-creator

skill-creator

1password

himalaya