DEDUPED Hot AI repos, turned into use cases Get the Monday 5

How to plan a relay server that keeps the API keys off the device with AI Chat Demo

Map each key-using call in the app to a server endpoint before any production release.

Short answer: Read the README note that says to put a relay server in front and keep the keys server-side; then List every place in app/src/openai/ and app/src/rag/ that uses a key from src/config.ts; Design a relay server with one endpoint for the model connection and one for the knowledge base search, and note which request fields the app would send to each. All steps.

Credentials. Until a relay exists, any build of this app exposes the OpenAI and Pinecone keys to anyone who extracts them from the bundle.

Who it is forA team lead or developer preparing to ship a version of this chat app to real users who must keep OpenAI and Pinecone keys private.

The problemThe README warns that keys in the app bundle can be extracted by anyone, so a shipped build would expose the accounts.

The outcomeA written list of which app calls move behind a server, so the keys stay server-side.

What you need first

  • Xcode and CocoaPods for iOS, or the Android setup from the React Native environment guide
  • Node 22.11 or newer
  • An OpenAI API key
  • A Pinecone API key, a populated Pinecone index, and its index host

Steps

  1. Read the README note that says to put a relay server in front and keep the keys server-side.
  2. List every place in app/src/openai/ and app/src/rag/ that uses a key from src/config.ts.
  3. Design a relay server with one endpoint for the model connection and one for the knowledge base search, and note which request fields the app would send to each. (inferred, check the README)
  4. Update the app config so it points to the relay URL instead of holding keys, then test with npm run ios or npm run android. (inferred, check the README)

Prompt for your agent

For the margelo/ai-chat-demo repo, list each file that reads an API key from src/config.ts and propose a relay server design that holds those keys server-side. Output the endpoint list and one verification step that confirms no key remains in the app bundle.

Caveat. The repo does not include a relay server, so the server side is new work the team must build and secure.

Use this in your AI agent

Ask your agent

Using the Deduped MCP, get the setup steps for margelo/ai-chat-demo and "Plan a relay server that keeps the API keys off the device"

Add Deduped to Claude Code once

claude mcp add --transport http deduped https://dedupedai.com/mcp

Cursor, ChatGPT, others

Share: X LinkedIn Hacker News Email Copy link

Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer