A Secure API Key Belongs Behind a Server

An API key placed in front-end code is already exposed. Minification, environment variables, and private repository settings may slow discovery, but they cannot change the basic fact: the browser must receive anything it uses. A visitor can inspect network requests, browser storage, bundled JavaScript, or developer tools and recover the credential.

The reliable design keeps the key on a server you control. The browser sends an application request to that server, the server authenticates the user, applies policy, adds the provider credential, forwards the request, and returns a carefully selected result. The secret remains outside the browser throughout the exchange.

The browser turns every embedded secret into public data

Begin by listing every front-end call that currently reaches an external API. Record the destination, request purpose, user inputs, response fields, and credential involved. This inventory often reveals more than one problem: a key may appear in a JavaScript bundle, a build setting, a test page, or persistent browser storage.

Assume that any credential previously shipped to users has been copied. Remove it from the client, revoke it at the provider, and issue a replacement. A deleted line does not invalidate a token that someone has already captured.

A narrow backend endpoint creates the security boundary

Build one backend endpoint for each meaningful product operation, or group closely related operations behind a small service. The endpoint should accept only the fields the interface needs. It should reject unexpected inputs, validate types and lengths, and apply limits before making an upstream request.

This boundary gives you a place to authenticate users, check permissions, enforce quotas, record usage, and return consistent errors. It also prevents the browser from choosing arbitrary providers, models, system instructions, or billing targets.

The server should own credentials and upstream request details

Store provider keys in the server’s secret management system or protected runtime environment. Read them only in server processes, and keep them out of logs, error messages, analytics payloads, and client responses. Give each environment and service the smallest credential scope that supports its work.

The server should construct the upstream request from trusted policy. A user may provide a message or document, while the server decides the permitted model, limits, tools, and spending controls. Rotate credentials regularly and immediately after suspected exposure.

Request validation limits abuse before costs accumulate

Authentication alone does not prevent misuse. Add rate limits per account, session, network source, and operation where appropriate. Set maximum input sizes, output limits, timeouts, and concurrency bounds. Reject requests that exceed those limits before they reach the provider.

For model APIs, validate content and tool parameters according to the provider’s rules. Return only the fields the interface needs, especially when upstream responses may contain internal metadata, usage details, or provider diagnostics.

Relay services can simplify provider access without exposing keys

A managed relay can occupy the upstream side of this architecture when your backend needs a consistent API surface. BestRelay is a quality-first API relay that forwards each request to the official model named in it, with no substitution. It covers Claude, GPT, Gemini, DeepSeek, Kimi, GLM, Qwen, Grok, and other providers, and works with Claude Code, Codex, Gemini CLI, and OpenAI SDK applications.

For example, a server can keep its relay credential private while selecting an approved model such as Claude Sonnet 5.5 or Gemini 3.1 Pro according to application policy. BestRelay bills pay-as-you-go from provider-reported token counts, with cache reads and writes priced separately. Members also earn a referral commission when invited users top up. Create a BestRelay account when this relay model fits your server-side architecture.

Testing must prove the secret stays outside client responses

Inspect production-like browser bundles and network traffic after moving the integration. Search responses, source maps, storage, logs, and error reports for key patterns and provider credentials. Test unauthenticated requests, invalid input, excessive payloads, repeated calls, and attempts to select disallowed models.

Review the change as an attacker would. A user should be able to call only your permitted application endpoint, with only the data and capabilities assigned to that account. If an upstream key appears anywhere in browser-visible content, the boundary is incomplete.