OpenAI API keys are server-only. Any key shipped in a browser or app can be extracted and used to run up your bill. Call OpenAI from a server or edge proxy, use project-scoped keys with spending limits, and enforce model and token caps on the server.
Bills usage to your organization. Scope per project and environment.
Clients send the user message only. The proxy chooses the model, system prompt, and output limits.
Set monthly budgets and usage alerts per project so one leak cannot drain the whole org.
Require a client token or session and apply per-user limits before forwarding prompts.
Build tools inline those into the bundle, where bots scrape them within minutes.
Attackers will switch to the most expensive model and max out token limits.
Return only the generated text the UI needs to keep payloads small.
Store OPENAI_API_KEY in the vault, lock model and max tokens inside the pipeline config, and require an rc_live_ client token so only your app can call the endpoint.
Not safely in production. The key would be visible to every visitor. Use a server or edge proxy that injects it.
To use OpenAI in a client-side React app without leaking your secret key, never include OPENAI_API_KEY or REACT_APP_OPENAI_API_KEY in frontend .env files. Instead, route your fetch calls through a RealComposer edge endpoint that injects your secret key server-side on Cloudflare Workers and enforces CORS origin whitelisting.
To prevent API keys from leaking through the Bubble.io API Connector, route high-value third-party requests through RealComposer. RealComposer stores credentials encrypted at the edge and filters bloated responses, reducing the payload size that Bubble servers must parse.
Framer generates pure React client components where hardcoded API keys are visible to anyone viewing browser source code. Route requests through RealComposer to inject secrets at the edge and enforce domain origin protection.
Never embed OpenAI keys in iOS app bundles or Info.plist files; tools like strings, Ghidra, and Hopper easily extract constants. Call RealComposer from Swift URLSession to inject keys on Cloudflare Workers.
To solve combine openai embeddings and supabase vector search in one call, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.
To combine anthropic claude with openai fallback router, use one RealComposer pipeline with parallel steps. Primary Anthropic Messages step plus OpenAI fallback step in one pipeline. Your Frontend / Web app makes one request instead of several sequential upstream calls.
An LLM gateway, also called an AI gateway, is a proxy layer between applications and large language model providers such as OpenAI and Anthropic. It injects API keys server-side, enforces rate limits and budgets, caches responses, logs usage, and can fail over between models.
API KeyAn API key is a unique secret string that identifies the application calling an API and authorizes its access. Providers use keys to authenticate requests, enforce quotas, and bill usage. Anyone holding the key can act as your application, so secret keys must stay on trusted servers.
API Rate LimitingAPI Rate Limiting is a traffic control mechanism that caps the number of requests a client, IP address, or API token can execute within a specified time window. Rate limiting prevents server overloading, protects against credential brute-forcing, and shields upstream APIs from exceeding subscription quotas.
API AbuseAPI abuse is the misuse of an API in ways it was not intended, such as using leaked keys, scraping data at scale, exhausting quotas, or automating fraudulent actions. Abuse can cause large unexpected bills, data theft, and service degradation for legitimate users.