Developer guide
How to protect AI API keys in a mobile app
A practical guide to why bundled API keys are exposed and how a verified server-side gateway can limit abuse in iOS and Android AI apps.
Why keys in the app aren't secrets
A mobile app runs on a user's device. Even when credentials are obfuscated, a determined attacker may inspect the binary or observe requests. Long-lived provider secrets belong on infrastructure you control.
A safer request path
The app authenticates its user and presents a device or app integrity signal. Your server validates these signals, checks authorization and usage budgets, then invokes the model provider using credentials stored server-side.
What App Attest and Play Integrity do—and don't do
Apple App Attest and Google Play Integrity provide integrity signals that help reduce unauthorized clients. They do not replace user authentication, per-user authorization, request validation, monitoring or rate limits. Design for devices and environments where attestation is unavailable.
Protect against unexpectedly high bills
Enforce limits per user and app, not only per provider key. Distinguish normal user traffic from repeated retries or automated abuse. Log costs and investigate spikes before they become a large bill.
Where Relaykit fits
Relaykit is being developed around mobile-specific request verification, gateway-mediated provider access and cost visibility. Join early access to help shape the integration workflow.
Building AI features for mobile?
Relaykit is inviting developers to shape early access. Free during early access; future paid pricing has not been finalized.
Request early access