Why the backend is required
You must never call the AI API directly from the browser. If you do, every visitor sees your secret key, and they can spend your money.
The safe pattern always routes through your server:
Browser --> Your Server --> AI API
Your server:
- Holds the secret key (safe from pruned eyes).
- Can enforce limits, like one message per second.
- Can log conversations for debugging.
This architecture scales from a hobby project to a real product with no changes.