What is Secure Custom AI Chat?
Secure Custom AI Chat is an open-source, self-hosted web application that provides a unified chat interface for interacting with large language models (LLMs) from multiple AI providers. It runs as a lightweight Node.js server that proxies requests to AI providers — meaning your API keys stay on the server and are never exposed to the browser.
The application works with any provider that supports the OpenAI-compatible API (chat/completions) or the Anthropic Messages API. This includes cloud providers like OpenAI, Anthropic, OpenRouter, Groq, Together AI, DeepSeek, and Mistral, as well as local models running via Ollama or LM Studio.
Core ProblemWhat problem does it solve?
Using AI APIs directly from the browser exposes your API key to anyone who inspects network requests. Most self-hosted chat interfaces require you to hardcode keys in frontend code or paste them into a URL.
Secure Custom AI Chat solves this by acting as a server-side proxy: the server receives your message, appends the API key, and forwards the request to the provider. The browser only ever communicates with your own server.
ALLOW_USER_PROVIDERS=0), your API key is set once in the server environment and never leaves the server. Even if the frontend is compromised, no key is accessible.Who is it for?
Developers
Test different AI models and providers from a single interface. Switch between OpenAI GPT, Claude, Groq, and local Ollama models without leaving your browser.
Teams & Organizations
Deploy a single instance with server-side API keys. Team members get AI access without needing individual API accounts or key management.
Privacy-Conscious Users
Use AI with full transparency. No account required, no data sent to third-party services beyond the AI provider you choose. Chat history stays in your browser.
Home Lab Users
Connect to Ollama or LM Studio running on your local machine for fully private, offline-capable AI conversations with no API costs.
How does it work?
The application consists of two parts:
- Backend (Node.js + Express) — Serves static files, handles API proxying, validates provider URLs, enforces rate limiting, and applies security headers.
- Frontend (Vanilla JavaScript PWA) — Single-page chat interface with real-time SSE streaming, local conversation history, provider configuration, and PWA support for installation.
When you send a message:
- The frontend sends a
POST /api/chatrequest to your server with the message, model, and settings. - The server validates the provider URL (SSRF protection), builds the appropriate API payload, and forwards it to the AI provider using streaming.
- The server streams the provider's SSE response back to the browser in a normalized format.
- The frontend renders the streamed tokens in real-time using
requestAnimationFrame.
Technology Stack
Node.js + Express
Lightweight backend using native Node.js fetch. No heavy frameworks. Runs on any Node.js 18+ environment.
Vanilla JavaScript
No frontend framework dependencies. Pure browser APIs for DOM manipulation, streaming, and PWA features.
Helmet + Rate Limiting
Security headers via Helmet, rate limiting via express-rate-limit. SSRF protection via DNS resolution and IP validation.
Progressive Web App
Service worker for offline shell caching. Web App Manifest for installability. Works on iOS, Android, and desktop.
Open Source
Secure Custom AI Chat is open-source software available under the MIT License. You are free to self-host, modify, and deploy it for personal or commercial use.
The software is provided as-is without warranty. You are responsible for securing your deployment, including setting strong authentication if deploying publicly.