How to Build a Secure AI Proxy with Cloudflare Workers to Hide API Keys

·1 views

Exposing AI API keys directly in browser-side code is a widespread and dangerous mistake that can lead to stolen credits, large bills, and account suspension. The Backend-for-Frontend (BFF) proxy pattern solves this by routing requests through a secure middleware layer instead of calling AI providers directly from the client. This guide demonstrates how to build a lightweight, serverless proxy using Cloudflare Workers that securely stores API keys as environment variables and forwards sanitized requests to Groq or OpenAI. The implementation covers scaffolding the Worker with the create-cloudflare CLI, managing secrets via Wrangler, and writing TypeScript logic to validate input, handle CORS, and return AI responses. The approach avoids the overhead of a traditional Express server while keeping sensitive credentials entirely off the client side.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Opinion: Reframing Goals Around Experience Can Redefine Success

A blog post published on Starting From Nix argues that shifting one's focus from outcomes to experiences can change how success is measured. The author suggests that when experience itself becomes the primary goal, failure in conventional terms becomes impossible. The piece encourages readers to reconsider how they define winning in personal and professional pursuits. The article has gained early traction on Hacker News, though discussion remains limited at this stage.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

AWS Bedrock Adds Temporal Policies as AI Agent Control Moves Beyond the Model

AWS this week expanded Amazon Bedrock AgentCore with temporal policies and an open-source policy language called Dogwood, enabling AI agent gateways to evaluate sequences of actions rather than individual tool calls in isolation. The update addresses scenarios where each single action appears compliant but the cumulative pattern violates organizational intent, such as an agent making multiple near-limit purchases. The architectural shift places runtime control outside the model itself, meaning agents no longer rely on faithfully recalling constraints from their prompts. A parallel trend is emerging across the ecosystem, with platforms like Tenable's CyberAgents Exchange decomposing agents into discrete, reusable components including skills, plans, and policies. However, analysts note that runtime policy enforcement still leaves open a deeper question: determining whether the underlying organizational judgment or evidence actually warrants an approval, a problem distinct from simple tool authorization.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How I Protected My Express API from Spam and High AI Costs Using Redis

When I was building my backend API, I realized a big problem: anyone could spam my endpoints. If a user repeatedly reloads a page or hits an endpoint calling an external AI service, it can crash the server or run up high API costs. To fix this, I added Rate Limiting. Here is why I used Redis for it and how I set it up. At first, I thought about saving request counts in a simple JavaScript object: // ❌ Simple in-memory check (Not good for production) const requestCounts = {}; app.use((req, res, next) => { const ip = req.ip; requestCounts[ip] = (requestCounts[ip] || 0) + 1; if (requestCounts[ip]

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds zero-dependency Go clipboard tool for terminal-based text sharing

A developer has released cpynet, a single-file Go binary designed to simplify text sharing between remote servers and local machines entirely from the terminal. The tool requires no signup, no database, and no external dependencies, operating purely through curl commands over standard HTTP. Snippets are stored in memory only and auto-delete either after the first read or when a configurable TTL expires. For sensitive data, the tool supports AES-256-GCM client-side encryption, ensuring the server never processes plaintext. The project was motivated by the friction developers face when using traditional pastebins or clipboard utilities in headless or restricted server environments.

0 comments Read more at DEV Community