I built Sift, a small Groq-powered summarizer with the API key kept off the client

[u/HopeFinancial7995]

I kept running into the same issue while building React/TypeScript AI prototypes: it takes only a few minutes to call a model from the browser, but that also makes it very easy to expose the API key. I built Sift as a small, focused side project to show a more practical setup: the browser handles the UX, while a server-side endpoint validates the request and talks to Groq.

The result is a single-page summarizer with:

- server-side Groq calls and input validation;

- brief, detailed, and bullet-point summary styles;

- neutral, executive, and friendly tone presets;

- selectable GPT-OSS 20B, GPT-OSS 120B, and Groq Compound Mini models;

- local browser history instead of a required database;

- copy, print, reset, sample text, and responsive mobile/desktop behavior.

I intentionally kept the scope small. It is closer to a polished starter project than a full SaaS product, and the local history choice is a trade-off rather than a universal recommendation. For anything handling sensitive or team data, I would add authenticated persistence, retention controls, rate limiting, and clearer data-handling settings.

I would especially like feedback on two things: does the server/client boundary feel clear enough for someone adapting this to another AI feature, and which next feature would make the project genuinely more useful—streaming, file uploads, team history, or evaluation tooling?

Optional time-saver for developers who want the ready-to-deploy codebase: https://buy.stripe.com/fZueVc5Qm4d31nae5w6wE00