Where JavaScript Fits: Browser, Node.js, and Edge
JavaScript can power the UI, backend orchestration, streaming, tool adapters, and evaluation harnesses. Keep secret API keys on a trusted server; browser bundles are inspectable. A browser can call your own backend, which then calls the provider. Node.js is useful for API routes, background workers, ingestion pipelines, and scheduled jobs. Edge runtimes can reduce latency but may impose limits on Node APIs, execution duration, and package compatibility.
A clean separation is: browser for interaction, server for credentials and policy, workers for slow or batch jobs, and storage for application state and retrieval indexes.
Diagram
Safe request boundary
// Browser: call your own backend, not the model provider with a secret key.
const response = await fetch("/api/ai/answer", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ question })
});
if (!response.ok) throw new Error("AI request failed");
const result = await response.json();💡 The browser sends a user request to an application endpoint. That endpoint authenticates the user, validates the payload, applies limits, and calls the provider using a server-side secret.
Key Takeaways
- Never ship provider secrets to browsers.
- Choose runtime based on execution and package constraints.
- Keep credentials, authorization, and rate limits at the backend boundary.
Knowledge Check
Where should a long-lived provider API secret normally live?