Security¶
Secrets Management¶
All provider credentials and service keys are stored as Cloudflare Secrets and injected at runtime via the env object. No secrets are hardcoded in source code.
Required Cloudflare Secrets¶
| Secret | Purpose |
|---|---|
SUPABASE_URL |
Authentication backend URL |
SUPABASE_KEY |
Authentication backend service key |
NVIDIA_API_KEY |
Upstream provider API key |
ZEN_AUTH |
Upstream provider auth header |
Set them via the Cloudflare Dashboard or CLI¶
npx wrangler secret put SUPABASE_URL
npx wrangler secret put SUPABASE_KEY
npx wrangler secret put NVIDIA_API_KEY
npx wrangler secret put ZEN_AUTH
Response Obfuscation¶
- All API responses mask internal provider details.
- The
info.providerfield always returns"x0root"regardless of which upstream provider handled the request. - Error messages from upstream providers are sanitized before being returned to the client.
Client Safety¶
Danger
Avoid exposing real API keys in the standalone HTML client (chat (1) (1).html). Only embed a key there if you intentionally want browser users to have it.