Recipe: mobile & webview

Reaching oprag from a native app or a webview without shipping a secret.

Server Integration key, on your server dev · https://api.dev.oprag.ai

A mobile binary is not a secret. Anything shipped inside it — including an integration key in a config file — can be extracted, so a native app talks to your server and your server talks to oprag.

Approach	Key	Verdict
Native app calls your API, your API calls oprag	`sk_live_` on your server	Recommended. The key never leaves your infrastructure.
Webview loads a page you host, page uses the widget	`embed_live_` in the page	Fine. The origin allowlist still applies, so allowlist the hosting origin.
Native app ships an integration key	`sk_live_` in the binary	Never. Assume it is public the day you ship.

Webview

Host a small page that mounts the widget inline and point the webview at it. Because the page is served from an origin you control, the embed key's origin allowlist keeps working exactly as it does on the web.

chat.html HTML

<div id="chat-panel" style="height: 100vh"></div>
<script type="module">
  import { mountWidget } from "https://cdn.oprag.ai/sdk/widget.js";

  await mountWidget({
    projectId: "proj_abc123",
    embedKey: "embed_live_...",
    apiUrl: "https://api.dev.oprag.ai",
    target: document.getElementById("chat-panel"),
    launcher: false,
  });
</script>

Native

Everything else goes through a backend for frontend. Your app sends a question to your API; your API adds the integration key and passes the ids back so the conversation stays multi-turn.

Ready to ship?

Get started free