Every mobile developer eventually hits the same wall: the app needs to talk to some third-party API (OpenAI, Stripe, SendGrid, whatever) and that API wants a secret key. You know you shouldn’t ship the key in the binary (binaries are trivially inspectable), but the “correct” answer is standing up and maintaining your own proxy backend, which is a ridiculous amount of overhead for an indie app that makes three API calls.
KVProxy is the product my friend Sterling and I built to close that gap. It’s a hosted key-value proxy platform: you store your API keys encrypted in the KVProxy dashboard, define rules for which requests should be proxied, and the platform injects the secrets server-side as requests flow through. The rules engine is generic find-replace over any part of a request (headers, GET params, host, JSON body) so beyond key injection you can do things like dynamically steer between AI providers or swap model parameters without shipping an app update. Clients are attested with DeviceCheck and bound to their app ID, so there is no key to store client-side, and everything is metered with per-rule rate limiting and usage analytics.
On the client, integration is one line:
KVProxyInitialize(projectId: "<YOUR_PROJECT_ID>")That single line is the part of the project I’m proudest of. Most SDKs in
this space make you route traffic through their client object, or at least
change your base URLs — which means they can’t help with networking that
happens inside third-party libraries you don’t control. KVProxy instead
registers a custom URLProtocol and swizzles it into every
URLSessionConfiguration in the process. Every request from every session
— including sessions created deep inside somebody else’s SDK — runs
through fast local rule matching, and the ones that match are
transparently rerouted through the proxy. The approach turned out to be
highly novel: it made the system work for essentially any use case and
any third-party library with zero code changes. Your networking code
doesn’t know KVProxy exists; the keys just show up server-side.
The work split naturally: I wrote the dashboard, the proxy backend, and a lot of the iOS library, with Sterling and I trading design and review across the whole stack.
KVProxy is also a personal milestone: it was my last hurrah as a fully-manual programmer. This is the final side project I wrote essentially entirely by hand (some tab-completion here and there, but no agentic coding.) Everything I’ve built since has had an AI agent in the loop, so I’m glad the last one was something this fun.
We launched at the peak of SaaS-death and couldn’t find a user base, so we decided to open source the whole thing.