Hide OpenAI API Key in a Flutter App
Flutter AI chat without an OpenAI key in the APK
OpenAI keys bundled in Flutter apps through env files, assets, or dart-define are extractable from release builds. Route chat requests through a RealComposer pipeline that injects OPENAI_API_KEY at the edge, applies per-client rate limits, and returns only the reply text to the app.
Why OpenAI keys in Flutter builds get abused
Scrapers routinely unpack mobile apps looking for sk- prefixed keys. Once found, the key is used for unrelated workloads billed to your account until you notice and rotate it, which then breaks every installed copy of the app.
- OpenAI keys extracted from flutter_assets or env files
- Surprise usage bills from leaked keys
- Rotating the key breaking older app versions
How RealComposer Solves This at the Edge
Store credentials in Secret Vault
Save OPENAI_API_KEY in RealComposer so the value never enters the Flutter project.
Configure the edge pipeline
Add the upstream steps with vault header injection, set allowed origins, and map only the fields the screen binds.
Post chat messages with dio
Call your workspace edge URL with a restricted rc_live_ client token.
final res = await Dio().post(
'https://realcomposer.com/v1/workspace/hide-openai-api-key-flutter',
data: {'messages': [{'role': 'user', 'content': prompt}]},
options: Options(headers: {'Authorization': 'Bearer rc_live_client_token'}),
);
final reply = res.data['reply'];
{
"id": "chatcmpl-9x",
"object": "chat.completion",
"model": "gpt-4o-mini",
"system_fingerprint": "fp_44709d6fcb",
"choices": [
{
"index": 0,
"finish_reason": "stop",
"message": {
"role": "assistant",
"content": "Here is your summary."
},
"logprobs": null
}
],
"usage": {
"prompt_tokens": 212,
"completion_tokens": 48,
"total_tokens": 260
}
}
{
"reply": "Here is your summary."
}
Recipe Specs
- HTTP method
- POST
- Upstream calls
- 1
- Edge cache TTL
- No caching
- Client auth
- Restricted client token
- Mapped output fields
- 1
- Payload
- 306 B to 33 B (-89%)
curl -X POST "https://realcomposer.com/v1/workspace/hide-openai-api-key-flutter" \ -H "Authorization: Bearer rc_live_client_token"
Developer Questions & Troubleshooting
Is flutter_dotenv safe for OpenAI keys?
No. flutter_dotenv loads a .env file packaged as an asset, which ships inside the app and can be read after unpacking.
Can I rotate the OpenAI key without an app update?
Yes. Update the secret in the RealComposer vault and every installed app keeps working because it only holds the client token.
Sources & Definitions Used in This Answer
Deploy this Flutter + OpenAI Recipe
Clone this pre-configured pipeline into your RealComposer workspace in one click. We pre-populate upstream URLs, headers, and mapping rules.