Search code examples
flutterfirebasegoogle-cloud-firestoreopenai-api

what is the correct way to save chatgpt api-key for flutter app/firebase

I have made some research, some said I have to hardcoded but using obfuscation in my client app, I see this may be a easy way. But I am not sure for the following reason:

  1. Since I need to check how many tokens one user is using, anyway I need firebase as my backend/server to give the permission to the specific user, in this case saving chatgpt apikey in firebase is better?
  2. The other solution like a. --dart-define; b.ENVied/.env seems not hundred percent safe, so I do not have such experience how to save such as chatgpt api level, should I follow this solution?

So do we have some official solution or any existing tutorial how to handle the connection between chatgpt api and flutter app?

==============Update===============

Hi Alex I have read your medium article and have following questions:

  1. Is it safe to use firebase extension where I input my openai api-key? I am confused where to save this openai api-key in the end: Google Cloud Console/Secret manager or Chatbot with ChatGPT Firebase Extension?

  2. I know flutter instead of android, from my understanding in your resource, it seems a user can directly connect with firebase and chatgpt since I input my openai apikey in the Chatbot with ChatGPT Firebase Extension, so how can we control how many tokens this user is allowed to use?

  3. Do you have also some article introducing the third-party-payment api such as stripes or revenueCat, so firebase knows the specific user is a premium user and give more chatgpt quota?

Thanks!

Solution

  • If want to save the OpenAI API Key on the client, which I recommend against it, you can indeed do it by obfuscating it, but the safest place would be to store it in Google Cloud. So you should open your Google Cloud Console, select your project, then go to the Secret Manager at:

    And create your secret key. The benefit of using this approach is that the encryption is managed by Google. So you don't have to worry about it.