API Proxy
A route on your own server that forwards calls to someone else's API, so the secret key never ships to the browser.
See it
What it is
An API proxy is a route on your own server that receives a request from your app, forwards it to somebody else's API, and passes the answer back. The point is that the secret key lives on your server (an environment variable) instead of in JavaScript anyone can read with view-source. A Next.js route handler, an Express route, or a Cloudflare Worker are all fine homes for one.
Besides hiding keys, a proxy is where you fix the annoying parts: it sidesteps CORS (server to server calls have no browser rules), it lets you trim a fat third-party response down to the five fields your UI wants, and it gives you one place to add caching, retries, and logging. This is the honest answer to 'it works in Postman but not in my site'.
The trap: a proxy with no auth of its own is a free public API funded by your credit card. Anyone can hit '/api/ai' in a loop and burn your quota. Add session checks, per-user rate limits, and an allowlist of which upstream paths and params you will forward. Also watch platform timeouts, since serverless functions cut long streaming responses off unless you stream through them deliberately.
Ask AI for it
Create a server-side API proxy route for this third-party API. Put it at app/api/[service]/route.ts as a Next.js route handler that reads the key from process.env (never NEXT_PUBLIC_), forwards only an allowlist of paths and query params, and returns the upstream JSON with upstream status codes preserved. Add a per-IP rate limit, a 10 second timeout with AbortController, and strip any upstream headers that leak vendor detail. Then update the client code to call my proxy route instead of the vendor URL.