DEV Community

Cover image for Deploy a real AI chat app in one click — key stays server-side (Vercel/Render/Railway)
Seven
Seven

Posted on

Deploy a real AI chat app in one click — key stays server-side (Vercel/Render/Railway)

#webdev #ai #serverless #javascript

Most "deploy an AI app in 5 minutes" tutorials quietly do the one thing you must never do: put an API key where a browser can see it. This post is three one-click starters that are correct by construction — the key is a deploy-time environment variable, server-side only, never in client code, never committed to git.

Each template is provider-neutral: it defaults to an OpenAI-compatible endpoint (https://daoxe.com/v1) but points at any compatible endpoint by changing one variable. Pick the one that matches what you're building.

Disclosure: I work on daoxe, the OpenAI-compatible gateway these default to. Everything below works against any compatible endpoint — the default and the "powered by" link are one-line changes.

The rule that makes these safe

An LLM API key is a billing credential. Anything shipped to a browser is public. So every template here follows the same discipline:

  • DAOXE_API_KEY (and any tokens) are deploy-time env vars, declared in each platform's config with no baked-in value.
  • .env.example files ship empty placeholders.
  • The key is used server-side only — an Edge function, a proxy server, or a bot process holds it; the browser never sees it.

If a tutorial ever tells you to paste your key into front-end JavaScript, close the tab.

Template 1 — Streaming chat UI on Vercel

A minimal chat UI backed by an Edge function that holds the key and streams tokens back to the browser. Good for: a demo, an internal tool, a landing-page assistant.

Repo: seven7763/daoxe-vercel-chat

Deploy: click the Vercel button in the repo README; Vercel prompts you for two env vars:

  • DAOXE_API_KEY — your key.
  • DAOXE_MODEL — an exact id from GET /v1/models.

That's it — you get a URL with a working streaming chat. The browser calls your Edge function; the Edge function calls the gateway with the key. The key never leaves the server.

Browser ──▶ /api/chat (Edge, holds key) ──▶ https://daoxe.com/v1/chat/completions
        ◀── streamed tokens ◀──────────────
Enter fullscreen mode Exit fullscreen mode

Optional DAOXE_ALLOWED_MODELS lets you restrict which models the function will serve.

Template 2 — OpenAI-compatible proxy on Render

Sometimes you don't want a UI — you want to share one key with a team or a script without handing out the real credential. This template is a tiny OpenAI-compatible proxy: it exposes /v1/chat/completions, injects the real key server-side, and gates access with a token you hand out instead.

Repo: seven7763/daoxe-render-proxy

Deploy: click the Render button in the repo README; set DAOXE_API_KEY (the real key) and a share token. Now teammates point their OpenAI-compatible tools at your proxy URL with the share token — they get model access, never your billing credential. It also serves a live /healthz page.

Template 3 — Discord bot on Railway

A Discord bot that answers /ask with an LLM. Good for: team assistants, support bots, community helpers.

Repo: seven7763/daoxe-railway-discord-bot

Deploy: from the public repo, open Railway → New Project → Deploy from GitHub (or create a Template once), then set DAOXE_API_KEY, DAOXE_MODEL, and your Discord bot token. The bot process holds the key; Discord users just type /ask. (This one has a single runtime dependency, discord.js.)

Env vars cheat sheet

Variable Where Notes
DAOXE_API_KEY all three Billing credential. Server-side only.
DAOXE_MODEL vercel-chat, railway bot Exact id from GET /v1/models.
DAOXE_ALLOWED_MODELS vercel-chat (optional) Comma-separated allowlist.
Share / Discord tokens render proxy / railway bot Separate from the billing key.

(Repos are public. Vercel/Render one-click buttons live in each README; Railway is "Deploy from GitHub" from the public repo — no private template id required.)

What this buys you

  • Three one-click AI starters: Vercel (streaming chat), Render (OpenAI-compatible proxy), Railway (Discord bot).
  • Key never in the browser — the failure mode most tutorials ship by accident.
  • One key → many models behind a single OpenAI-compatible base URL, with fallback and one bill if you want it.

Don't trust the pitch — deploy one template, open the network tab, and confirm the key is not in any client request. Then point the same templates at any OpenAI-compatible endpoint and compare.

Top comments (0)