Frontend direct calls versus backend proxies: keep persistent keys out of browsers
Compare direct browser requests with backend forwarding, distinguishing persistent keys, temporary credentials and result validation.
Choose an approach
Keep persistent service keys in the backend, which validates requests and calls the model. Some realtime interfaces support scoped temporary credentials, but that does not permit publishing persistent keys. Choose according to authentication and features, not merely one fewer network hop. Proxies still need scope and error handling.
Browser-accessible values cannot remain server secrets
OpenAI warns against persistent keys in browsers or mobile clients. A build variable named secret is still client content if shipped to visitors. A backend retains credentials, but an unrestricted public proxy remains abusable. For temporary realtime credentials, check scope and issuance rather than treating them as ordinary service keys. One successful response proves only that request returned a result.
Check authentication and errors on the same public request
Use public prompts and inspect actual browser content and requests for persistent credentials. Test missing application authorization and service timeouts in the proxy, returning clear errors without exposing internals. For temporary credentials, test expiry and prohibit fallback to public persistent keys. Check complete output and request identifiers, not only the first visible token. No proxy was deployed or account credential changed here.
Maintain limits and connection recovery
Backends need quotas, sanitized logs and error mapping; frontends need cancellation and reconnect handling. Temporary credentials still need reliable issuance. Include backend operation and diagnosis without assuming proxies are always slower or direct access always cheaper. Preserve configuration and rollback and recheck credential locations after updates. Hidden buttons or minified code do not substitute for server-side secrets.
Checked sources
These sources support the concepts and methods described here. Examples and test scope are labeled separately; check the version of the tools you use.