Server-Side AI Architecture

API keys never touch the browser — all AI calls routed through Supabase Edge Functions

Client
Browser (React App)
No API keys stored here
PKCE Auth XSS Protected
HTTPS + JWT Token
Server
Supabase Edge Functions
Deno runtime · Encrypted secrets
CORS Restricted API Keys Here
Authenticated API Call
Provider
Google Gemini
Flash · Pro
Provider
OpenAI
GPT-4o
Provider
Anthropic
Claude
Storage
Supabase (PostgreSQL)
Row-level security · Encrypted at rest
Key insight: API keys are stored as encrypted Edge Function secrets. They never appear in client-side code, network requests, or browser storage.