Your AI-built app wants your API key. I built drobek so it never gets it.

说明与用途

Drobek 通过在服务器端注入 API 密钥并执行严格的访问控制，安全地为 AI 生成的前端应用提供外部 API 调用。

问题

AI-generated front‑end apps often need to call external APIs, but exposing API keys in client‑side code is insecure.

结果

Drobek enables secure, fine‑grained API access for AI‑built front‑end apps by keeping secrets on the server, enforcing SSRF protection, and allowing operators to enable only the necessary backend modules.

工作流

• 1. Author writes a browser app that calls drobek’s SDK.
• 2. The app uses drobek.proxy.fetch to request an upstream API, e.g. PokéAPI.
• 3. The drobek server checks the request against registered upstreams and SSRF rules.
• 4. If the upstream requires a secret, the server injects it from the dashboard before forwarding.
• 5. The response is returned to the browser without exposing the key.
• 6. Operators can enable or disable modules (auth, data, files, forms, email, proxy) per app.
• 7. The app’s SDK enforces server‑side access rules; UI changes alone do not grant permissions.

证据

The agent writes the browser app, while backend modules run on the drobek server.

来源

A proxy module can attach an API key without putting that key in the generated JavaScript.

来源

The proxy also checks destinations against SSRF rules, blocks private and reserved addresses by default, and applies request limits.

来源

Keeping a key on the server protects the key itself. It does not make the data returned by the API private.

来源