Hide Anthropic API Key in an Expo App
Claude chat in Expo without secrets in EXPO_PUBLIC_
EXPO_PUBLIC_ variables and app config extra fields are inlined into every Expo build and EAS Update bundle, so an Anthropic key placed there is public. Call a RealComposer pipeline instead: it injects ANTHROPIC_API_KEY as the x-api-key header at the edge and returns just the reply text.
Why Expo apps leak Anthropic keys
Developers often move keys into EXPO_PUBLIC_ variables assuming environment variables are private. Expo inlines them into the JavaScript bundle, and EAS Update serves that bundle to every device, where it can be downloaded and searched.
- Anthropic key inlined into the Hermes bundle
- OTA updates redistributing the key to every install
- Large Messages API payloads parsed on the JS thread
How RealComposer Solves This at the Edge
Store credentials in Secret Vault
Save ANTHROPIC_API_KEY in RealComposer so the value never enters the Expo project.
Configure the edge pipeline
Add the upstream steps with vault header injection, set allowed origins, and map only the fields the screen binds.
Call the pipeline from Expo
Call your workspace edge URL with a restricted rc_live_ client token.
const res = await fetch('https://realcomposer.com/v1/workspace/hide-anthropic-api-key-expo', {
method: 'POST',
headers: { Authorization: 'Bearer rc_live_client_token', 'Content-Type': 'application/json' },
body: JSON.stringify({ messages: [{ role: 'user', content: prompt }] }),
});
const { reply } = await res.json();
{
"id": "msg_01Xf",
"type": "message",
"role": "assistant",
"model": "claude-sonnet-4-5",
"stop_reason": "end_turn",
"content": [
{
"type": "text",
"text": "Your itinerary is ready."
}
],
"usage": {
"input_tokens": 180,
"output_tokens": 32
}
}
{
"reply": "Your itinerary is ready."
}
Recipe Specs
- HTTP method
- POST
- Upstream calls
- 1
- Edge cache TTL
- No caching
- Client auth
- Restricted client token
- Mapped output fields
- 1
- Payload
- 216 B to 36 B (-83%)
curl -X POST "https://realcomposer.com/v1/workspace/hide-anthropic-api-key-expo" \ -H "Authorization: Bearer rc_live_client_token"
Developer Questions & Troubleshooting
Can I store the Anthropic key as an EAS secret?
Only for build steps. If app code reads it at runtime, it is bundled into the app and becomes public.
Does this work in Expo Go and dev clients?
Yes. The app only makes a standard fetch to the edge URL, so it behaves the same in Expo Go, development builds, and production.
Sources & Definitions Used in This Answer
Deploy this Expo + Anthropic Recipe
Clone this pre-configured pipeline into your RealComposer workspace in one click. We pre-populate upstream URLs, headers, and mapping rules.