# Security Onboarding

Welcome to the **Groq Security Onboarding** guide.  
This page walks through best practices for protecting your API keys, securing client configurations, and hardening integrations before moving into production.

## Overview

Security is a shared responsibility between Groq and our customers.  
While Groq ensures secure API transport and service isolation, customers are responsible for securing client-side configurations, keys, and data handling.

All Groq API traffic is encrypted in transit using TLS 1.2+ and authenticated via API keys.

## Secure API Key Management

Never expose or hardcode API keys directly into your source code.  
Use environment variables or a secret management system.

**Warning:** Never embed keys in frontend code or expose them in browser bundles. If you need client-side usage, route through a trusted backend proxy.

## Key Rotation & Revocation

* Rotate API keys periodically (e.g., quarterly).
* Revoke keys immediately if compromise is suspected.
* Use per-environment keys (dev / staging / prod).
* Log all API key creations and deletions.

## Transport Security (TLS)

Groq APIs enforce HTTPS (TLS 1.2 or higher).
You should **never** disable SSL verification.

## Input and Prompt Safety

When integrating Groq into user-facing systems, ensure that user inputs cannot trigger prompt injection or tool misuse.

**Recommendations:**

* Sanitize user input before embedding in prompts.
* Avoid exposing internal system instructions or hidden context.
* Validate model outputs (especially JSON / code / commands).
* Limit model access to safe tools or actions only.

## Rate Limiting and Retry Logic

Implement client-side rate limiting and exponential backoff for 429 / 5xx responses.

## Logging & Monitoring

Maintain structured logs for all API interactions.

**Include:**

* Timestamp
* Endpoint
* Request latency
* Key / service ID (non-secret)
* Error codes

**Tip:** Avoid logging sensitive data or raw model responses containing user information.

## Secure Tool Use & Agent Integrations

When using Groq's **Tool Use** or external function execution features:

* Expose only vetted, sandboxed tools.
* Restrict external network calls.
* Audit all registered tools and permissions.
* Validate arguments and outputs.

## Incident Response

If you suspect your API key is compromised:

1. Revoke the key immediately from the [Groq Console](https://console.groq.com/keys).
2. Rotate to a new key and redeploy secrets.
3. Review logs for suspicious activity.
4. Notify your security admin.

**Warning:** Never reuse compromised keys, even temporarily.

## Resources

- [Groq API Documentation](/docs/api-reference)
- [Prompt Engineering Guide](/docs/prompting)
- [Understanding and Optimizing Latency](/docs/production-readiness/optimizing-latency)
- [Production-Ready Checklist](/docs/production-readiness/production-ready-checklist)
- [Groq Developer Community](https://community.groq.com)
- [OpenBench](https://openbench.dev)

<br/>

*This security guide should be customized based on your specific application requirements and updated based on production learnings.*

---

## Production-Ready Checklist for Applications on GroqCloud