AI · Security · Mobile apps
Your AI app's API key is a credit card: five ways to protect it
Every tap on Generate costs real money. How we protect the AI budget in a paid mobile app: device identity, app attestation, server-side keys, store-verified purchases and a live cost console.
Techoship LLC · November 12, 2026 · 1 min read
In a normal app, a bug costs you a bad review. In an AI app, a single exposed endpoint can cost you the month's budget overnight, because every request to the model is billed. If a script can call your generate endpoint, it will.
When we built an app that redesigns a room from one photo, protecting that cost mattered as much as the AI itself. These are the five layers we used.
1. Identity is the device, not a person
The app has no email or password sign-up. Each install registers as a device. There is nothing personal to breach, and every request can still be tied to the install that made it.
2. The app proves it is genuine
On iOS the app uses Apple App Attest; on Android, Firebase App Check. The server can tell a real install of the real app from a script replaying requests.
3. The model key never leaves the server
Generation happens server-side only. No build of the app contains the AI provider's key, so there is nothing to extract from the app package.
4. Purchases are checked with Apple and Google
Credits are granted only after the server verifies the receipt with the store. A modified app that claims it paid gets nothing.
5. A console that shows cost and margin
The admin console shows AI spend against revenue, today and this month. That is the difference between a business and an expensive hobby: you see a problem in hours, not on the invoice.
If you are building an AI product, work out your cost per user before launch. Then make sure only your real app, used by paying users, can spend it.
Planning something similar?
A free consultation, then a written plan and a fixed quote.