Guide · Build
Never ship your API key inside the app
Anything inside your app binary can be read. Put a small server between your app and the AI provider.
If your app uses an AI service, it needs an API key. The easy mistake is to put that key in the app itself: in a Swift constant, a config file or Info.plist. I made this mistake, and it cost me money and broken features.
Why it's dangerous
An app downloaded from the App Store can be unpacked, and its text can be searched. A key stored in the code or in Info.plist is just a string in the file. Hiding it with simple tricks only slows someone down. Once a key leaks, strangers can run their own requests on your account until you notice, and when you revoke the key, every installed copy of your app stops working.
The fix: a small proxy
Put a tiny server between your app and the AI provider. The app talks to your server. Only the server knows the real key.
- Create a serverless function. Cloudflare Workers has a free tier that covers most indie apps.
- Store the API key as a secret on the worker, never in its code.
- Have the app send a task name and the user's input, not a full prompt. The worker builds the prompt, so nobody can use your proxy as a free general-purpose AI.
- Release the app update that uses the proxy.
- Only after that update is live, create a new key and delete the old one.
Extra protection
- Use a separate key and project for each app, so a problem in one app doesn't affect the others.
- Set a monthly spending limit with your AI provider.
- Limit how many requests one device can make per day.
Treat every string in your app as public. If it would hurt to see it posted online, it belongs on a server.