Lesson 3 of 8
Keep Keys on the Server
Secret API keys belong on a trusted server, not in browser JavaScript that every visitor can inspect.
Active reading
Browser
Assume users can inspect it.
Server
Store secrets and enforce rules.
Provider
Receives authenticated requests.
The browser is not a secret storage location
Anything shipped to the browser can be inspected. Environment variables only protect a key if the value stays on the server during runtime.
Let the browser call your server. Your server validates the request, adds the secret credential and calls the model provider.
Example
Safe shape: browser → POST /api/chat → server reads secret key → provider.
Quick check
Explain this lesson back in one sentence before continuing. If you cannot, reread the example and key takeaway.
Common mistake
Never publish a private API key in HTML, frontend JavaScript or a public repository.
Key takeaway
Keep secrets server-side and expose only the minimum application endpoint the browser needs.