Production-ready templates for calling third-party APIs from Expowithout exposing secrets or maintaining a custom backend.
Expo safe & unsafe practicesEXPO_PUBLIC_ variables and app config extra fields are inlined into every Expo build and EAS Update bundle, so an Anthropic key placed there is public. Call a RealComposer pipeline instead: it injects ANTHROPIC_API_KEY as the x-api-key header at the edge and returns just the reply text.
The Supabase service_role key bypasses row level security, so it must never appear in an Expo app or OTA update. Keep the anon key in the app for normal queries and send privileged reads to a RealComposer pipeline that holds service_role in the vault and returns filtered fields.