Stop Building Backends Just to Hide One API Key

Alper San — Sun, 08 Feb 2026 19:52:35 +0000

You're building the next big AI wrapper or a sleek Single Page Application (SPA). You have your OpenAI key, your frontend is ready in React/Vue/Svelte, and you're about to ship.

But wait. 🛑

You can't put sk-proj-... in your client-side code. Everyone knows that.

So now you have to:

Spin up a Node/Express server (or a Next.js API route).
Set up CORS.
Deploy it (Vercel/Heroku/EC2).
Maintain it.
Pay for it. Just to make one API call? That feels like overkill.

The Problem with "Backend for Frontend"

For simple integrations (AI agents, weather apps, payment links), building a dedicated backend service introduces unnecessary friction. You spend more time configuring IAM roles and middleware than actually building your product.

But exposing keys is not an option. Bots scrape GitHub and public repos instantly. Your $500 credit could vanish in seconds. 💸

The Solution: A Secure Proxy Layer

What if you could keep your frontend code clean but still protect your keys?

That's why I built SaltingIO. It acts as a secure "Salt Layer" between your frontend and the API provider.

How it works:

Paste your raw API key (OpenAI, Anthropic, Stripe, etc.) into the Salting dashboard. We encrypt it instantly. 🔒
Get a Bridge URL. We give you a unique endpoint like https://api.salting.io/r/your-bridge-id.
Ship. Use that URL in your frontend fetch() call. No backend required. Example: Secure OpenAI Call in React

Before (Insecure ❌):

const response = await fetch('https://api.openai.com/v1/chat/completions', {
  headers: {
    'Authorization': 'Bearer sk-proj-12345...' // EXPOSED!
  }
});

After (Secure ✅):

const response = await fetch('https://api.salting.io/r/your-bridge-id', {
  method: 'POST',
  body: JSON.stringify({ model: 'gpt-4', messages: [...] })
});

Why This Matters for Indie Hackers

• Speed: Ship in minutes, not hours.

• Security: Your keys never leave our encrypted vault.

• Control: Set rate limits per user (e.g., "Max 10 requests/day per IP"). Prevent abuse without writing a single line of Redis code.

• Analytics: See exactly who is using your API and how much.
I built this because I was tired of setting up lambdas for every side project. If you're building in public or shipping fast, give it a try.

👉 Secure your API Keys with SaltingIO

Stop Building Backends for Simple API Calls

DEV Community: Alper San

Stop Building Backends Just to Hide One API Key

How it works:

Why This Matters for Indie Hackers