Checklists /Ship to the App Store /Secrets and backend

Critical

Call model providers through your own API

An OpenAI, Anthropic or other model key inside an Expo or Swift app will be extracted, and the bill comes to you. The app should call your own endpoint. That endpoint holds the provider key and checks that the caller is allowed to spend it.

How to check

1. Search the app for api.openai.com, api.anthropic.com, generativelanguage.googleapis.com, and Authorization headers built in the client.
2. The binary should not contain a provider secret. A request from the device should go to your domain.
3. On the server, confirm the route rejects a caller who is not signed in, or who has passed a quota you chose.
4. Run one real prompt from a release build and confirm the provider dashboard shows the request coming from the server, not from a leaked key.

Prompt

You are working in this iOS project. Do not add features.

Goal: The iOS app calls our server for model requests. The provider key stays on the server.

The project may be Expo, React Native, Swift, a Capacitor wrapper, or a FlutterFlow export. Change only files that already exist.

Steps:
1. Find client calls to model providers and the key they send.
2. Replace them with a call to a server route I name, sending the user session rather than the provider key.
3. On that server route, read the provider key from server-only configuration and reject unauthenticated calls.
4. Do not print the provider key. Tell me if one was previously shipped in the app so I can rotate it.
5. Do not print certificates, private keys, API keys, or App Store Connect passwords.
6. Tell me which files you changed, and list anything I still have to do in Xcode or App Store Connect.

Mark as done

This uses the same ticks as the checklist page, saved in this browser.