Prepare the integration boundary
Keep model IDs and credit costs in server-side configuration. The browser should submit a prompt and options to your own API rather than exposing a provider key.
- Authenticate every paid generation request
- Validate prompt length, model and aspect ratio server-side
- Store provider keys outside the client bundle
- Rate-limit creation and polling endpoints