The decision
A browser bundle is public. Any API key shipped in client code can be copied by a visitor and used outside your interface. Send a constrained request to your server, authenticate or rate-limit it as needed, validate input, and make the provider call with a server-only secret.
A worked example
A draft form submits note text to /api/draft. The server checks input length, user entitlement, daily usage, and permitted model settings. The browser never chooses an arbitrary provider URL or receives a credential. The server returns the result or a public failure message, with no provider headers exposed.
How to put it into practice
- Use server-only environment variables and keep them out of public prefixes and serialized page data.
- Restrict the operation rather than exposing a generic model proxy.
- Apply per-user and global limits, including concurrent work and maximum output size.
- Log request IDs, duration, and cost without logging private source text by default.
A failure to plan for
Hiding a button does not protect an endpoint. Attackers can call the route directly, spoof a user-supplied identifier, and bypass browser validation. Authorization must use trusted server context.
Try it on your project
Inspect your built browser assets for a harmless test secret. Then send an oversized direct request and a request without the required identity. Both should fail before a provider call occurs.
Keep the next step small
Use the free demand scorecard or planning tools to make your assumptions explicit. The $19 launch kit brings the blueprint and seven editable worksheets together.