Start with the diagnosis
Putting an API key in browser JavaScript exposes it to every visitor and can create unexpected charges.
Step by step
01
Create a server-side endpoint
Confirm the result before moving to the next step.
02
Store the key in a secret environment variable
Confirm the result before moving to the next step.
03
Validate user identity and input
Confirm the result before moving to the next step.
04
Add per-user rate limits and quotas
Confirm the result before moving to the next step.
05
Log cost and errors without sensitive prompts
Confirm the result before moving to the next step.
Safety checklist
- Never return the provider key to the browser
- Add moderation appropriate to the use case
- Provide a fallback when the provider fails