Browser-to-Server Boundary: What Stays Secret and What Can Ship
Understand the critical security boundary between browser and server when interacting with AI models. This lesson helps you identify what data can be safely exposed to the client and what credentials must remain protected server-side to prevent unauthorized access. Learn operational rules and strategies to keep provider keys secure while enabling reliable, observable AI feature interactions in web applications.
The chat turn model from the last chapter assumed messages and events move safely between the UI and the model. This lesson is about the one part of that path where safety isn’t automatic: the boundary between your browser and everything else.
A production build ships, a user opens DevTools, and an OpenAI provider key appears in the downloaded JavaScript bundle. Within hours, traffic spikes from unfamiliar IPs, your provider quota drains, and requests start failing after the key is revoked. Nothing about this failure is subtle because the browser boundary is not a security boundary.
This lesson draws the boundary for LLM calls so later code places credentials and policy decisions on the correct side. ...