Add an AI chatbot to your HTML app without leaking your API key

Adding a chat assistant to an app is one of the most popular ideas right now. It is also where many first-time developers make an expensive mistake: they paste their AI API key straight into the JavaScript.

Anyone can open an APK and read the files inside. If your key is in there, someone will find it, and you will pay for their usage. Here is how to do it properly.

The rule: the key never goes in the app

Your app should talk to your server. Your server holds the key and talks to the AI provider. The app never sees the key at all.

Phone app  →  your small proxy  →  AI provider
              (holds the key)

This proxy can be tiny. A serverless function on Cloudflare Workers, for example, is a few dozen lines and has a generous free tier.

A minimal proxy

// Cloudflare Worker. The key is stored as a secret, not in code.
export default {
  async fetch(req, env) {
    if (req.method !== 'POST') return new Response('Not allowed', { status: 405 });
    const { message } = await req.json();
    if (!message || message.length > 2000) return new Response('Bad request', { status: 400 });
    // Call your AI provider here with env.AI_KEY and return its answer.
  }
};

Store the key with the platform's secrets feature so it never appears in your code or your repository.

Limit what the proxy can do

• Cap the input size. Reject huge messages before they reach the AI.
• Fix the model and settings on the server. Do not let the app choose an expensive model.
• Rate limit. A few requests per minute per user is plenty for a chat feature.
• Set a spending limit with your AI provider, so a bug can never become a huge bill.

Calling it from your app

From your HTML app, a normal fetch to your proxy is all you need. Show a typing indicator while you wait, and handle errors kindly: phones lose signal, and the AI service can be busy.

Remember the store rules

An app that generates text with AI falls under Google Play's policy for AI-generated content. You need a way for users to report offensive output, and your privacy policy and Data safety form must mention that messages are sent to a third-party service. We cover both in our guide to the policy and in privacy for AI apps.