Your AI-built app wants your API key. I built drobek so it never gets it.

Описание и применение

Drobek позволяет безопасно использовать внешние API в AI‑сгенерированных фронтенд‑приложениях, скрывая ключи от клиента и применяя строгие правила доступа.

Задача

AI-generated front‑end apps often need to call external APIs, but exposing API keys in client‑side code is insecure.

Результат

Drobek enables secure, fine‑grained API access for AI‑built front‑end apps by keeping secrets on the server, enforcing SSRF protection, and allowing operators to enable only the necessary backend modules.

Рабочий процесс

• 1. Author writes a browser app that calls drobek’s SDK.
• 2. The app uses drobek.proxy.fetch to request an upstream API, e.g. PokéAPI.
• 3. The drobek server checks the request against registered upstreams and SSRF rules.
• 4. If the upstream requires a secret, the server injects it from the dashboard before forwarding.
• 5. The response is returned to the browser without exposing the key.
• 6. Operators can enable or disable modules (auth, data, files, forms, email, proxy) per app.
• 7. The app’s SDK enforces server‑side access rules; UI changes alone do not grant permissions.

Доказательства

The agent writes the browser app, while backend modules run on the drobek server.

Источник

A proxy module can attach an API key without putting that key in the generated JavaScript.

Источник

The proxy also checks destinations against SSRF rules, blocks private and reserved addresses by default, and applies request limits.

Источник

Keeping a key on the server protects the key itself. It does not make the data returned by the API private.

Источник