The Key
Stays Locked
Meet Vault. He's a real AI assistant wired to Google's Gemini — and he's also the point of this page. The secret key he needs never reaches your browser. It stays on the server. Ask him anything.
How a message travels
Sends your message. No key attached.
/api/chatAdds the key, calls Gemini, returns only the reply.
🔒 Key stays here
Generates the answer and sends it back.
Your browser only ever talks to my server, never to Google directly. That single hop is what keeps the key out of sight.
What's under the hood
What this is
A working chat assistant connected to Google's Gemini model. The interesting part isn't the chat bubble — it's running one on a live, public website while keeping the secret API key private. That's the easy thing to get wrong, so it's the part worth showing.
What happens when you hit send
Your message doesn't go to Google. It goes to a small program of
mine at /api/chat running on a server. That program
adds the key, asks Gemini, and sends back only the answer.
Why the key stays hidden
The Gemini key lives only on the server, in Google's secret
storage, and is never written into this page. View the source or
open the network tab and all you'll find is the request to
/api/chat and the reply. If the page called Gemini
directly, the key would be sitting in plain sight for anyone to copy.
When Gemini is busy
Now and then Gemini is briefly overloaded. Rather than showing an error, the page waits a moment and retries a couple of times, so a short hiccup usually never reaches you. A "busy" reply contains no answer, so retrying one costs effectively nothing.
Open your browser's developer tools, go to the Network tab, and send
Vault a message. You'll see the request to /api/chat —
and no API key anywhere in it. That's the whole demo.