Security: Managing API Credentials
mainWhen using third-party providers (OpenAI, Anthropic, Google Gemini), never hardcode API credentials. Use one of these two production-ready patterns:
- Bring Your Own Key (BYO): Users provide their own keys, which you store securely in the system Keychain. This keeps credentials client-side and hardware-protected.
- Proxy Server: Route requests through your own authenticated service. API keys are stored on your server, and the client uses short-lived, scoped bearer tokens (e.g., via OAuth 2.1).