AI in apps without a backend: bring your own key

AI features can turn a good app into a much better one. A dictated thought becomes a set of cleanly worded tasks; a photographed receipt becomes a completed form. The usual architecture looks like this: the app sends data to its own server, the server calls the language model and pays for it. For our apps Avantido and ContoTrip we deliberately left that server out. The principle is called “bring your own key”.

The principle

Users store their own API key from an AI provider of their choice in the app's settings: Google Gemini, OpenAI or Anthropic Claude. The app sends requests directly from the device to that provider. As the app maker, we run no server, no database and no user accounts for it. The provider bills AI usage directly to the user; it is not part of the app's purchase price.

This has several advantages for us. There is no infrastructure to run, secure and scale. There are no ongoing AI costs to finance through subscriptions. And we simply never get to see what our users send.

One service, three providers

Under the hood there is a single AIService. It talks to the OpenAI-compatible chat completions API. Gemini, OpenAI and Claude all run through the same code; only the base URL and the model change per provider. That keeps the app lean and turns switching providers into a setting rather than a rewrite.

The key belongs in the Keychain

An API key is a means of payment. Whoever holds it can run up costs on someone else's bill. We therefore store it exclusively in the device's Keychain – never in UserDefaults or in a file. The key only ever leaves the device on its way to the chosen provider.

A connection test instead of guesswork

A key copied incorrectly is by far the most common problem. The settings therefore include a connection test. It shows immediately whether provider, model and key fit together – before the first real request fails.

Structured results, confirmed by the user

A language model returns text. An app needs fields. So we ask for a clearly defined, structured response: in Avantido, tasks with a title and a priority; in ContoTrip, the fields of a receipt such as merchant, date, amount, currency, category and the individual line items.

The next step is what matters: nothing is saved unchecked. Users see the suggestions, can adjust titles and priorities or deselect individual entries, and only then confirm. In our apps, AI makes suggestions; it does not act on its own.

Privacy, thought through to the end

Without a server of our own, many things get simpler – but not everything is settled. Our privacy policies spell out three points explicitly:

• No configuration, no transfer. As long as no provider is set up, no text and no image leaves the device.
• The whole content is transferred. For receipt recognition, the complete receipt image goes to the provider. It may contain details the app itself neither evaluates nor stores, such as a truncated card number. Anyone who wants to avoid that can enter such receipts by hand.
• The provider's terms apply. What happens to the data at the AI provider is governed by that provider's privacy policy. We say so plainly and promise nothing we do not control.

In the App Store privacy label, too, we chose the more honest option: the transfer to the AI provider is declared as data collected by a third party, not linked to the user and not used for tracking.

Where the approach reaches its limits

“Bring your own key” is not right for every product. The biggest hurdle is the key itself. Many people have never created an account with an AI provider. An app built this way therefore needs a clear, step-by-step guide, and every feature that does not rely on AI has to remain fully usable without a key.

A second hurdle is App Review. If the advertised features require a key, Apple's reviewers have to be able to try them as well – otherwise a rejection under Guideline 2.1 is likely. We therefore provide a working test key in the review notes, together with step-by-step instructions, and delete it again once the app has been approved.

Conclusion

AI features do not require a backend of your own. With a cleanly encapsulated service, the key in the Keychain and a confirmation step for the user, voice, text and photos can be turned reliably into structured data – without the app maker ever seeing the content. Whether this approach suits your product, or whether a server of your own makes more sense, is something we are glad to work out with you.