API-key proxy for mobile & frontend apps

Ship AI features.
Keep your keys.

Calling OpenAI, Gemini or Replicate straight from your app means shipping your API key with it — where it gets extracted and drained. MyAppToken is a reverse proxy that injects the real key server-side. Your app just swaps the base URL.

Start free with Google See how it works

No SDK. No backend to build. No credit card — free while in beta.

your-app.swift

// Before: your OpenAI key ships inside the app 😬
- let baseURL = "https://api.openai.com/v1"
- let apiKey  = "sk-proj-…"   // extractable in minutes

// After: the proxy injects the key server-side
+ let baseURL = "https://api.myapptoken.com/api/v1/proxy/
+                <app-id>/openai"
+ let apiKey  = jwt            // short-lived, per-user

// Same request paths, same responses. That's the
// whole integration.
POST {baseURL}/chat/completions

Works with OpenAI Google Gemini Replicate fal.ai BackgroundCut …and any other HTTP API — not only LLMs.

Up and running in three steps

You keep using each provider's native API — MyAppToken is a transparent passthrough, not another abstraction layer.

Create an app & service

openai → https://api.openai.com/v1

Store your API key

Paste the provider key into the token vault. It never leaves the server side again — rotate or revoke it without an app release.

sk-proj-… → 🔒 stored, masked, rotatable

Swap the base URL

Your app authenticates its users with short-lived JWTs and calls the proxy. Everything else stays identical.

api.myapptoken.com/api/v1/proxy/<app>/openai/…

Everything the backend you didn't build would do

The proxy is also where you see and control how your app's users consume the APIs you pay for.

🔐

Token vault

Provider keys live server-side only. Create, rotate, deactivate and fail over between multiple keys per service — no app update needed.

📊

Per-user analytics

Requests, traffic, latency and status breakdowns per app, per service and per end user of your app — not just per API key.

🛡️

Abuse control

Per-user rate limits with rolling windows, automatic cooldowns, and one-click disabling of abusive users before they drain your account.

🧠

AI Insights

Periodic AI summaries of what your users actually ask, visualized as a weighted tag cloud from sampled prompts.

📱

Genuine-app checks

Optional Firebase App Check verification so only real builds of your app can use the proxy — not scripts with stolen tokens.

🔌

Any HTTP API

Provider-aware auth header handling and binary-safe passthrough: image, video and audio APIs work as well as chat.

Not another LLM gateway

LiteLLM and Portkey give backend teams one unified API across many LLMs. MyAppToken is for app developers who don't have a backend — and want to keep it that way.

	MyAppToken	LLM gateways (LiteLLM, Portkey…)
Built for	Mobile & frontend apps with no backend	Backend services
API shape	Transparent passthrough of each provider's native API	Unified OpenAI-style schema
Integration	Base-URL swap, no SDK	SDK or gateway endpoint
Non-LLM APIs	Yes — any HTTP service	LLM-focused
Analytics	Per app, service and end user of your app	Per key / team
Prompt-level insight	AI-generated usage summaries	Raw logging integrations

Questions developers ask

How do my app's users authenticate against the proxy?

Your app calls a simple auth endpoint with its app ID and a user identifier and receives a short-lived JWT. That JWT authorizes proxy calls and is what ties rate limits and analytics to individual users. Optionally, Firebase App Check ensures the call comes from a genuine build of your app.

What happens when someone abuses my app?

Per-user rate limits kick in automatically: past the limit, the user gets a 429 with a retry time and a cooldown window. You see rate-limited counts in the dashboard, and you can disable a specific user for a service with one click.

Do you store my users' prompts?

Request and response bodies are logged to power your statistics and AI Insights — they are your data, visible only to your account, and exportable as CSV. Per-service logging controls and configurable retention are on the roadmap; until then, see the privacy policy for details.

Does streaming work?

Responses are currently buffered — fine for image generation and short completions; token-by-token streaming for chat UIs is in active development.

What does it cost?

Free while in beta, including all features, with fair-use limits. Paid plans arrive with general availability — early users get founding-user pricing. See pricing.

Your key stays home. Ship the app.

Open the dashboard

Ship AI features.Keep your keys.