Call OpenAI API from WeWeb Securely
AI features in WeWeb without an OpenAI key in the front end
An OpenAI key pasted into a WeWeb REST action is published with the app and readable in DevTools. Send WeWeb requests to a RealComposer pipeline instead. The edge injects OPENAI_API_KEY from the vault, checks the calling origin, and returns only the assistant message text.
Why WeWeb REST actions expose OpenAI keys
WeWeb builds a front-end app, so workflow actions and collection headers ship to every visitor. The WeWeb CORS proxy changes where the request is sent from, but the Authorization header is still defined in published app configuration.
- OpenAI key scraped from the published WeWeb bundle
- Unbounded token spend from bots replaying the endpoint
- Full completion payloads with usage data sent to the client
How RealComposer Solves This at the Edge
Store credentials in Secret Vault
Save OPENAI_API_KEY in RealComposer so the value never enters the WeWeb project.
Configure the edge pipeline
Add the upstream steps with vault header injection, set allowed origins, and map only the fields the screen binds.
Call the pipeline from a WeWeb workflow
Call your workspace edge URL with a restricted rc_live_ client token.
// WeWeb workflow: REST API request action
URL: https://realcomposer.com/v1/workspace/call-openai-from-weweb-securely
Method: POST
Headers: Authorization: Bearer rc_live_client_token
Body: { "messages": [{ "role": "user", "content": variables.prompt }] }
{
"id": "chatcmpl-9x",
"object": "chat.completion",
"model": "gpt-4o-mini",
"system_fingerprint": "fp_44709d6fcb",
"choices": [
{
"index": 0,
"finish_reason": "stop",
"message": {
"role": "assistant",
"content": "Here is your summary."
},
"logprobs": null
}
],
"usage": {
"prompt_tokens": 212,
"completion_tokens": 48,
"total_tokens": 260
}
}
{
"reply": "Here is your summary.",
"tokens": 260
}
Recipe Specs
- HTTP method
- POST
- Upstream calls
- 1
- Edge cache TTL
- No caching
- Client auth
- Restricted client token
- Mapped output fields
- 2
- Payload
- 306 B to 46 B (-85%)
curl -X POST "https://realcomposer.com/v1/workspace/call-openai-from-weweb-securely" \ -H "Authorization: Bearer rc_live_client_token"
Developer Questions & Troubleshooting
Does the WeWeb server proxy hide my OpenAI key?
No. It helps with CORS, but headers defined in the app are still part of the published configuration. Keep the key in a vault behind your own endpoint.
How do I stop abuse of the AI endpoint?
Set allowed origins to your WeWeb domains and apply per-client rate limits on the RealComposer pipeline.
Sources & Definitions Used in This Answer
Deploy this WeWeb + OpenAI Recipe
Clone this pre-configured pipeline into your RealComposer workspace in one click. We pre-populate upstream URLs, headers, and mapping rules.