Your AI-built app wants your API key. I built drobek so it never gets it.

Description and use

Drobek enables secure use of external APIs in AI‑generated front‑end apps by keeping keys on the server and enforcing strict access rules.

Problem

AI-generated front‑end apps often need to call external APIs, but exposing API keys in client‑side code is insecure.

Outcome

Drobek enables secure, fine‑grained API access for AI‑built front‑end apps by keeping secrets on the server, enforcing SSRF protection, and allowing operators to enable only the necessary backend modules.

Workflow

• 1. Author writes a browser app that calls drobek’s SDK.
• 2. The app uses drobek.proxy.fetch to request an upstream API, e.g. PokéAPI.
• 3. The drobek server checks the request against registered upstreams and SSRF rules.
• 4. If the upstream requires a secret, the server injects it from the dashboard before forwarding.
• 5. The response is returned to the browser without exposing the key.
• 6. Operators can enable or disable modules (auth, data, files, forms, email, proxy) per app.
• 7. The app’s SDK enforces server‑side access rules; UI changes alone do not grant permissions.

Evidence

The agent writes the browser app, while backend modules run on the drobek server.

Source

A proxy module can attach an API key without putting that key in the generated JavaScript.

Source

The proxy also checks destinations against SSRF rules, blocks private and reserved addresses by default, and applies request limits.

Source

Keeping a key on the server protects the key itself. It does not make the data returned by the API private.

Source