Speak API Security Best Practices

v20260423

speak-security-basics

This guide outlines essential security best practices for integrating the Speak API. It covers critical areas like securing API keys using secrets managers, ensuring audio data privacy by deleting local files, and maintaining compliance with major regulations such as COPPA and FERPA. Use this knowledge when building production-ready, secure language learning applications.

Security API Compliance Data Privacy Speak

Get Skill

76 downloads

Overview

Speak Security Basics

Overview

Security best practices for Speak API keys, audio data privacy, student data protection, and COPPA/FERPA compliance.

Prerequisites

Completed speak-install-auth setup
Valid API credentials configured
ffmpeg installed for audio processing

Instructions

API Key Security

# Never commit API keys
echo '.env' >> .gitignore
echo '.env.local' >> .gitignore

# Use secrets manager in production
export SPEAK_API_KEY="$(aws secretsmanager get-secret-value --secret-id speak/api-key --query SecretString --output text)"

Audio Data Privacy

// Speak processes audio on their servers — do NOT store student audio locally
// unless required by your application
class PrivacyAwareClient {
  async assessAndClean(audioPath: string, targetText: string, language: string) {
    try {
      const result = await this.client.assessPronunciation({
        audioPath, targetText, language,
      });
      return result;
    } finally {
      // Delete local audio file after assessment
      fs.unlinkSync(audioPath);
    }
  }
}

Student Data Protection

Never log student audio recordings
Redact student names from API logs
Store assessment scores, not raw audio
Implement data retention policies (delete after N days)
COPPA compliance for students under 13: parental consent required
FERPA compliance for educational institutions: student data agreements

Security Checklist

[ ] API keys in secrets manager, not code
[ ] Audio files deleted after processing
[ ] Student PII not logged
[ ] HTTPS enforced for all API calls
[ ] Rate limiting prevents abuse
[ ] Access logs maintained for audit

Output

Basics implementation complete
Speak API integration verified
Production-ready patterns applied

Error Handling

Error	Cause	Solution
401 Unauthorized	Invalid API key	Verify SPEAKAPIKEY environment variable
429 Rate Limited	Too many requests	Wait Retry-After seconds, use backoff
Audio format error	Wrong codec/sample rate	Convert to WAV 16kHz mono with ffmpeg
Session expired	Timeout after 30 min	Start a new conversation session

Resources

Next Steps

See speak-prod-checklist for production readiness.

Examples

Basic: Apply security basics with default configuration for a standard Speak integration.

Advanced: Customize for production with error recovery, monitoring, and team-specific requirements.

Info

Category Development

Name speak-security-basics

Version v20260423

Size 4.82KB

Source jeremylongshore/claude-code-plugins-plus-skills

Updated At 2026-04-28