Keep your API keys off the phone: AI features, done safely
If your API key is inside your app, someone can take it. Here’s the simple setup that keeps it on a server instead.
Samuel Audu21 Oct 2026·2 min read
AI & Tech
Adding an AI feature to your app feels like it should be one line: paste your key, call the model, done. That works on your laptop. It’s a problem the moment real people install your app.
Why the key can’t live in the app
Anything shipped inside an app can be pulled out of it. If your key is there, anyone determined enough can copy it and run up a bill on your account.
Put a small server in the middle
The app talks to your own server function. The server holds the key and talks to the AI provider. In Kujua Focus that server is a Supabase Edge Function.
textPhone app → your server function (holds the key) → AI provider- The key is stored as a secret on the server, never in your code
- The app only ever sees the AI’s answer
- You can add limits on the server so one user can’t burn your budget
Add one AI ability at a time
Start with one thing: a voice, a reply or a summary. Get it working and saved. Then add context, then memory. Each step stays small enough to test.
Written by
Samuel Audu
I build real products with AI and teach the process in a live class. More about me