# How do you handle API keys for OpenAI-compatible APIs in a CloudCannon setup? **URL:** \ **Category:** General\ **Created:** [November 13, 2026, 4:08am UTC](https://community.cloudcannon.com/t/how-do-you-handle-api-keys-for-openai-compatible-apis-in-a-cloudcannon-setup/663 "2026-11-13T04:08:03Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Nicholas\_Garcia](https://community.cloudcannon.com/letter_avatar_proxy/v4/letter/n/d26b3c/32.png) [@Nicholas\_Garcia](https://community.cloudcannon.com/u/Nicholas_Garcia)\ **Post date:** [November 13, 2026, 4:08am UTC](https://community.cloudcannon.com/t/how-do-you-handle-api-keys-for-openai-compatible-apis-in-a-cloudcannon-setup/663/1 "2026-11-13T04:08:03Z")
I’m building a small AI app with an OpenAI-compatible API and hosting the frontend on CloudCannon. I want users to be able to submit a prompt and get a response, but I’m stuck on key management. I don’t want to expose my API key in client-side code, but I also don’t want to build a full backend if I can avoid it. I’ve seen mentions of serverless functions or CloudCannon’s build hooks, but I’m not sure how that fits with an OpenAI-compatible endpoint. My main concern is security and rate limiting—if the key leaks, it could get expensive fast. Also, I’m not sure if CloudCannon’s environment variables are accessible at runtime for client-side requests or only during builds. Has anyone integrated an AI API with CloudCannon without a separate server? How did you handle authentication and keep the key safe? Any pointers would be appreciated. Looked around a bit more and [OpenAI-Compatible APIs for AI App Builders](https://aibuildercompare.com/blog/openai-compatible-api-for-ai-app-builders) came up while I was trying to figure out whether CloudCannon env vars are build-only. I still don’t have a clear answer on runtime access, so I’m wary of assuming a proxy will work without testing it.