Private betaThis is the SIGSHIP beta. Everything here is live for testers; the public launch is in January.SIGSHIP private betaOpen the app →
  1. Home
  2. The 17 checks
  3. Your AI key runs in the browser
✨ AI costs · Fix now (SEV-1)

Your AI key runs in the browser 

In plain English: Your app calls an AI service like OpenAI straight from the visitor's browser, which means your AI key is sent to every visitor. Anyone can copy it from their browser and run up your bill.

What happens if you ship it

A stranger copies your key from the network tab and spends your credit on their own project.

How to fix it technical

Remove dangerouslyAllowBrowser. Create a server route that holds the key, checks who is asking, and calls the AI provider for the browser.

Let your AI tool fix it

Paste this into Lovable, Bolt, Cursor, Replit or Claude Code:

Prompt for your AI tool
Fix this problem in my project: Your AI key runs in the browser. Remove dangerouslyAllowBrowser. Create a server route that holds the key, checks who is asking, and calls the AI provider for the browser. Change only what this fix needs, then tell me what you changed and anything I have to do myself.

Check your app

Run npx sigship in your project folder. It reports this problem as ai-key-in-browser, along with 16 other checks. Nothing leaves your computer. New to the terminal?

Questions

Why is calling OpenAI from the frontend dangerous?

Anything the browser can use, the visitor can read. Your key shows up in the browser's developer tools, and a stranger can use it for their own projects.

What is the safe way to call an AI API?

Create a small server route (or edge function) that keeps the key, checks who is asking, limits how often they can ask, and calls the AI service for them.

See every check · Jargon, explained