Server Proxy

Protect your API key in frontend applications.

When building client-side applications (Next.js, React, Vue, etc.), you shouldn't expose your API key in browser code. The server proxy routes requests through your backend, keeping credentials safe.

How It Works

1Browser (SDK Client)  →  Your Server (Proxy)  →  api.inference.sh2     ↓                         ↓                        ↓3  proxyUrl config        Injects API key         Processes request

1. Client sends request to your proxy endpoint (e.g., /api/inference/proxy)
2. Proxy reads INFERENCE_API_KEY from environment
3. Proxy forwards request to inference shell with authentication
4. Response passes back through to client

Choose Your Framework

Configure the Client

Once you've set up a proxy route, configure the SDK client:

1import { inference } from "@inferencesh/sdk";23const client = inference({4  proxyUrl: "/api/inference/proxy"  // Your proxy route5});67const result = await client.run({8  app: "infsh/flux",9  input: { prompt: "A sunset over mountains" }10});

Note: When using proxyUrl, you don't need to provide apiKey - the proxy handles authentication.

Security Notes

[!IMPORTANT] Never expose your API key in client-side code. The proxy exists specifically to keep credentials on your server.

The proxy validates that:

• Target URL is an inference.sh domain
• A credential is available (INFERENCE_API_KEY or a client Authorization header)
• Request includes the x-inf-target-url header (or the __inf_target query param for EventSource clients that cannot set headers)

Authentication precedence

When forwarding to api.inference.sh, the proxy resolves credentials in this order:

1. Client Authorization header — forwarded as-is when present (for example a session token from device authorization)
2. options.apiKey or a custom resolveApiKey handler
3. INFERENCE_API_KEY environment variable — injected as Bearer … when no client header is sent

This lets browser clients pass short-lived session tokens through your proxy without storing a long-lived API key on the server.

Forwarded request headers

The proxy forwards these to the upstream request:

• x-inf-* — any header with this prefix (for example x-inf-session-id)
• X-Client-Source — SDK name and version, used for telemetry attribution

Custom Proxy Logic

All framework handlers support customization. Common patterns:

Custom API Key Resolution

1// Load from secrets manager instead of env2createRouteHandler({3  resolveApiKey: async () => {4    return await vault.getSecret("INFERENCE_API_KEY");5  }6});

Adding Middleware

1// Add rate limiting, analytics, auth checks2export const POST = async (req: Request) => {3  // Check authentication4  const session = await getSession();5  if (!session) {6    return Response.json({ error: "Unauthorized" }, { status: 401 });7  }89  // Forward to proxy10  return route.POST(req);11};

Next Steps

• Vercel Deployment — Deploy with automatic env setup
• Running Apps — Execute AI tasks
• Streaming — Real-time progress updates