API Key Protection
The cornerstone of this application is that API keys are never exposed to the browser. In default mode (ALLOW_USER_PROVIDERS=0), the server is configured with one or more provider API keys via environment variables. The client never sees, stores, or sends these keys.
When you send a message, the request goes to your own server, which appends the key server-side and forwards it to the AI provider. The browser only communicates with your proxy.
Multi-ProviderMultiple AI Providers
Configure and switch between many AI providers from a single interface:
- OpenAI — GPT-4o, GPT-4o mini, o3, o3-mini, o4-mini
- Anthropic — Claude 3.7 Sonnet, Claude 3.5 Sonnet, Claude 3 Opus, Claude 3 Haiku
- OpenRouter — Access to 200+ models through a single API
- Groq — Fast inference with Llama, Mistral, and Gemma models
- Together AI — Wide model library with competitive pricing
- DeepSeek — DeepSeek-V3, DeepSeek-R1 reasoning models
- Mistral AI — Mistral Large, Mistral Nemo, Codestral
- Ollama — Run models locally on your machine
- LM Studio — Local inference server
Any provider that supports the OpenAI-compatible chat completions API or the Anthropic Messages API can be configured manually.
PerformanceReal-Time Streaming
Responses stream in real-time using Server-Sent Events (SSE). Tokens appear on screen as they are generated by the AI, providing a smooth, ChatGPT-like experience. The app uses requestAnimationFrame for efficient token-by-token rendering without unnecessary reflows.
Chat Interface
Conversation History
Multiple conversations with local history stored in IndexedDB. No server-side storage of your chats.
Copy & Export
One-click copy of any response. Export full conversations as Markdown files for record-keeping.
Stop Generation
Interrupt streaming responses at any time. Save partially-generated responses before stopping.
Keyboard Shortcuts
Enter to send, Shift+Enter for newline, Ctrl/Cmd+K to focus input. Full keyboard accessibility.
Installable PWA
The application is a Progressive Web App. On supported browsers, you can install it to your home screen or desktop for a native-app-like experience. It works offline for navigation (the chat UI shell is cached), though streaming requires a network connection.
- Chrome/Edge: Click the install icon in the address bar
- iOS: Tap Share → "Add to Home Screen"
- Android: Tap the menu → "Install app"
Provider Configuration
Click "AI Configure / Setup" in the sidebar to:
- Choose between OpenAI and Anthropic API protocols
- Enter a provider base URL and API key
- Select or enter a model name
- Set system prompt, temperature, and max tokens
- Test the connection before saving
Configuration is stored in localStorage on your device. It is not transmitted to any third party except when you explicitly send it to your own configured provider endpoint.
Server-Side Security
SSRF Protection
Provider URLs are validated via DNS resolution and IP checks before any request is made, preventing requests to internal network addresses.
Helmet Headers
Security headers are applied automatically: X-Frame-Options, Content-Security-Policy, Strict-Transport-Security, and more.
Rate Limiting
Request rate limiting protects against abuse. Configurable per-route with express-rate-limit.
Logging
Structured console logging for requests and errors. No sensitive key data is logged. Configurable log level.
User-Configured Providers (Optional)
Set ALLOW_USER_PROVIDERS=1 to enable per-user provider configuration. Users can enter their own API keys and base URLs, stored locally in their browser. Server-side keys remain protected in both modes.