Move API keys from bundled .env to backend-served (#5726)

## Summary
- New `GET /v1/config/api-keys` backend endpoint serves Deepgram,
Gemini, and Anthropic keys to authenticated users
- New `APIKeyService` singleton fetches keys from backend after sign-in,
holds in memory only (never persisted to disk)
- Bundled `.env` keys loaded as fallback during transition, overwritten
once backend keys arrive
- Developer API Keys UI in Settings > Advanced for custom key overrides
(like mobile app pattern)
- Keys cleared on sign-out
- Cloud Run backend already updated with all 3 keys in env vars

## How it works
1. App starts → loads `.env` (fallback keys for transition)
2. User signs in → `APIKeyService.fetchKeys()` calls backend
3. Backend returns keys → set in memory via `setenv()` 
4. ACP bridge, Gemini, Deepgram all use the backend-provided keys
5. Developer overrides in Settings take precedence over backend keys

## Next steps (after this merges)
- Remove API keys from `OMI_DESKTOP_APP_ENV` Codemagic secret (once
backend endpoint is deployed)
- Proxy Deepgram/Gemini calls through backend (eliminates key exposure
entirely)

## Test plan
- [x] Both Swift and Rust builds compile
- [x] Backend endpoint returns all 3 keys to authenticated user (tested
with curl)
- [x] App fetches keys from backend: "Fetched keys from backend
(deepgram=true, gemini=true, anthropic=true)"
- [x] Fallback works when backend unavailable
- [x] Chat works with backend-served keys
- [x] Retry with backoff (3 attempts, 1s/2s/4s)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: kodjima33

desktop/Backend-Rust/src/config.rs

@@ -64,6 +64,10 @@ pub struct Config {
     pub gce_source_image: String,
     /// GCS bucket for agent startup script (defaults to "based-hardware-agent")
     pub agent_gcs_bucket: String,
+    /// Deepgram API key for transcription (served to desktop clients)
+    pub deepgram_api_key: Option<String>,
+    /// Anthropic API key for chat (served to desktop clients)
+    pub anthropic_api_key: Option<String>,
 }
 
 impl Config {
@@ -123,6 +127,8 @@ impl Config {
             },
             agent_gcs_bucket: env::var("AGENT_GCS_BUCKET")
                 .unwrap_or_else(|_| "based-hardware-agent".to_string()),
+            deepgram_api_key: env::var("DEEPGRAM_API_KEY").ok(),
+            anthropic_api_key: env::var("ANTHROPIC_API_KEY").ok(),
         }
     }
 

desktop/Backend-Rust/src/main.rs

@@ -32,7 +32,7 @@ mod services;
 
 use auth::{firebase_auth_extension, FirebaseAuth};
 use config::Config;
-use routes::{action_items_routes, advice_routes, agent_routes, apps_routes, auth_routes, chat_routes, chat_sessions_routes, conversations_routes, crisp_routes, daily_score_routes, focus_sessions_routes, folder_routes, goals_routes, health_routes, knowledge_graph_routes, llm_usage_routes, memories_routes, messages_routes, people_routes, personas_routes, screen_activity_routes, staged_tasks_routes, stats_routes, updates_routes, users_routes, webhook_routes};
+use routes::{action_items_routes, advice_routes, agent_routes, apps_routes, auth_routes, chat_routes, chat_sessions_routes, config_routes, conversations_routes, crisp_routes, daily_score_routes, focus_sessions_routes, folder_routes, goals_routes, health_routes, knowledge_graph_routes, llm_usage_routes, memories_routes, messages_routes, people_routes, personas_routes, screen_activity_routes, staged_tasks_routes, stats_routes, updates_routes, users_routes, webhook_routes};
 use services::{FirestoreService, IntegrationService, RedisService};
 
 /// Application state shared across handlers
@@ -204,6 +204,7 @@ async fn main() {
         .merge(webhook_routes())
         .merge(crisp_routes())
         .merge(screen_activity_routes())
+        .merge(config_routes())
         .with_state(state);
 
     // Merge both (now both are Router<()>), then add layers

desktop/Backend-Rust/src/routes/config.rs

@@ -0,0 +1,31 @@
+// Client configuration routes
+// Serves API keys to authenticated desktop clients so keys are not bundled in the app binary.
+
+use axum::{extract::State, routing::get, Json, Router};
+use serde::Serialize;
+
+use crate::auth::AuthUser;
+use crate::AppState;
+
+#[derive(Serialize)]
+struct ApiKeysResponse {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    deepgram_api_key: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    gemini_api_key: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    anthropic_api_key: Option<String>,
+}
+
+/// GET /v1/config/api-keys — return API keys for the authenticated user
+async fn get_api_keys(State(state): State<AppState>, _user: AuthUser) -> Json<ApiKeysResponse> {
+    Json(ApiKeysResponse {
+        deepgram_api_key: state.config.deepgram_api_key.clone(),
+        gemini_api_key: state.config.gemini_api_key.clone(),
+        anthropic_api_key: state.config.anthropic_api_key.clone(),
+    })
+}
+
+pub fn config_routes() -> Router<AppState> {
+    Router::new().route("/v1/config/api-keys", get(get_api_keys))
+}

desktop/Backend-Rust/src/routes/mod.rs

@@ -7,6 +7,7 @@ pub mod apps;
 pub mod auth;
 pub mod chat;
 pub mod chat_sessions;
+pub mod config;
 pub mod conversations;
 pub mod crisp;
 pub mod daily_score;
@@ -31,6 +32,7 @@ pub use action_items::action_items_routes;
 pub use advice::advice_routes;
 pub use agent::agent_routes;
 pub use apps::apps_routes;
+pub use config::config_routes;
 pub use auth::auth_routes;
 pub use chat::chat_routes;
 pub use chat_sessions::chat_sessions_routes;

desktop/Desktop/Sources/APIClient.swift

@@ -4571,4 +4571,22 @@ extension APIClient {
             return nil
         }
     }
+
+    // MARK: - API Keys
+
+    struct ApiKeysResponse: Decodable {
+        let deepgramApiKey: String?
+        let geminiApiKey: String?
+        let anthropicApiKey: String?
+
+        enum CodingKeys: String, CodingKey {
+            case deepgramApiKey = "deepgram_api_key"
+            case geminiApiKey = "gemini_api_key"
+            case anthropicApiKey = "anthropic_api_key"
+        }
+    }
+
+    func fetchApiKeys() async throws -> ApiKeysResponse {
+        return try await get("v1/config/api-keys")
+    }
 }

desktop/Desktop/Sources/APIKeyService.swift

@@ -0,0 +1,93 @@
+import Foundation
+
+/// Fetches API keys from the backend at runtime instead of bundling them in the app.
+/// Developer overrides (set in Settings) take precedence over backend-provided keys.
+@MainActor
+final class APIKeyService: ObservableObject {
+    static let shared = APIKeyService()
+
+    // Backend-provided keys (in-memory only, never persisted to disk)
+    @Published private(set) var deepgramApiKey: String?
+    @Published private(set) var geminiApiKey: String?
+    @Published private(set) var anthropicApiKey: String?
+    @Published private(set) var isLoaded: Bool = false
+    @Published private(set) var loadError: String?
+
+    /// Effective key: developer override > backend-provided > nil
+    var effectiveDeepgramKey: String? {
+        nonEmpty(UserDefaults.standard.string(forKey: "dev_deepgram_api_key")) ?? deepgramApiKey
+    }
+
+    var effectiveGeminiKey: String? {
+        nonEmpty(UserDefaults.standard.string(forKey: "dev_gemini_api_key")) ?? geminiApiKey
+    }
+
+    var effectiveAnthropicKey: String? {
+        nonEmpty(UserDefaults.standard.string(forKey: "dev_anthropic_api_key")) ?? anthropicApiKey
+    }
+
+    /// Fetch keys from the backend. Call after Firebase auth is ready.
+    func fetchKeys() async {
+        loadError = nil
+
+        // Retry up to 3 times with backoff
+        for attempt in 1...3 {
+            do {
+                let keys = try await APIClient.shared.fetchApiKeys()
+                self.deepgramApiKey = keys.deepgramApiKey
+                self.geminiApiKey = keys.geminiApiKey
+                self.anthropicApiKey = keys.anthropicApiKey
+                self.isLoaded = true
+
+                // Set env vars so existing getenv() consumers keep working during transition
+                applyToEnvironment()
+
+                log("APIKeyService: Fetched keys from backend (deepgram=\(keys.deepgramApiKey != nil), gemini=\(keys.geminiApiKey != nil), anthropic=\(keys.anthropicApiKey != nil))")
+                return
+            } catch {
+                let delay = pow(2.0, Double(attempt - 1))
+                log("APIKeyService: Fetch attempt \(attempt)/3 failed: \(error.localizedDescription), retrying in \(delay)s")
+                if attempt < 3 {
+                    try? await Task.sleep(nanoseconds: UInt64(delay * 1_000_000_000))
+                }
+            }
+        }
+
+        loadError = "Failed to fetch API keys from backend"
+        log("APIKeyService: All fetch attempts failed — features requiring API keys will be unavailable")
+
+        // Still apply env vars from developer overrides if set
+        applyToEnvironment()
+    }
+
+    /// Clear all keys (e.g. on sign-out)
+    func clear() {
+        deepgramApiKey = nil
+        geminiApiKey = nil
+        anthropicApiKey = nil
+        isLoaded = false
+        loadError = nil
+
+        unsetenv("DEEPGRAM_API_KEY")
+        unsetenv("GEMINI_API_KEY")
+        unsetenv("ANTHROPIC_API_KEY")
+    }
+
+    /// Push effective keys into the process environment for backward compatibility.
+    private func applyToEnvironment() {
+        if let key = effectiveDeepgramKey {
+            setenv("DEEPGRAM_API_KEY", key, 1)
+        }
+        if let key = effectiveGeminiKey {
+            setenv("GEMINI_API_KEY", key, 1)
+        }
+        if let key = effectiveAnthropicKey {
+            setenv("ANTHROPIC_API_KEY", key, 1)
+        }
+    }
+
+    private func nonEmpty(_ s: String?) -> String? {
+        guard let s, !s.trimmingCharacters(in: .whitespaces).isEmpty else { return nil }
+        return s
+    }
+}

desktop/Desktop/Sources/AppState.swift

@@ -422,6 +422,13 @@ class AppState: ObservableObject {
             let key = String(parts[0]).trimmingCharacters(in: .whitespaces)
             // Skip comments
             guard !key.hasPrefix("#") else { continue }
+            // API keys are fetched from the backend at runtime (APIKeyService).
+            // Load them from .env as a fallback — APIKeyService.fetchKeys() will
+            // overwrite them with backend-provided keys once auth is ready.
+            let backendServedKeys = ["DEEPGRAM_API_KEY", "GEMINI_API_KEY", "ANTHROPIC_API_KEY"]
+            if backendServedKeys.contains(key) {
+              log("  Set \(key)=*** (fallback, will be overwritten by backend)")
+            }
             let value = String(parts[1]).trimmingCharacters(in: .whitespaces)
               .trimmingCharacters(in: CharacterSet(charactersIn: "\"'"))
             setenv(key, value, 1)
@@ -435,12 +442,7 @@ class AppState: ObservableObject {
       }
     }
 
-    // Log final state of important keys
-    if getenv("DEEPGRAM_API_KEY") != nil {
-      log("DEEPGRAM_API_KEY is set")
-    } else {
-      log("WARNING: DEEPGRAM_API_KEY is NOT set")
-    }
+    log("Environment loaded (API keys will be fetched from backend after auth)")
   }
 
 

desktop/Desktop/Sources/AuthService.swift

@@ -321,6 +321,7 @@ class AuthService {
 
         AnalyticsManager.shared.identify()
         AnalyticsManager.shared.signInCompleted(provider: "apple")
+        Task { await APIKeyService.shared.fetchKeys() }
 
         if !AnalyticsManager.isDevBuild {
             let sentryUser = User(userId: userId)
@@ -436,6 +437,7 @@ class AuthService {
             // (identify must happen before events for PostHog person profiles to work)
             AnalyticsManager.shared.identify()
             AnalyticsManager.shared.signInCompleted(provider: provider)
+            Task { await APIKeyService.shared.fetchKeys() }
 
             // Set Sentry user context for error tracking (skip in dev builds)
             if !AnalyticsManager.isDevBuild {
@@ -1010,6 +1012,7 @@ class AuthService {
 
         try Auth.auth().signOut()
         isSignedIn = false
+        APIKeyService.shared.clear()
         // Clear saved auth state and tokens
         saveAuthState(isSignedIn: false, email: nil, userId: nil)
         clearTokens()

desktop/Desktop/Sources/MainWindow/Pages/SettingsPage.swift

@@ -261,6 +261,7 @@ struct SettingsContentView: View {
         case preferences = "Preferences"
         case troubleshooting = "Troubleshooting"
         case gmailReader = "Gmail Reader"
+        case developerKeys = "Developer API Keys"
 
         var icon: String {
             switch self {
@@ -277,6 +278,7 @@ struct SettingsContentView: View {
             case .preferences: return "slider.horizontal.3"
             case .troubleshooting: return "wrench.and.screwdriver"
             case .gmailReader: return "envelope.fill"
+            case .developerKeys: return "key"
             }
         }
     }
@@ -295,6 +297,11 @@ struct SettingsContentView: View {
     @State private var isDeletingAccount: Bool = false
     @State private var deleteAccountError: String?
 
+    // Developer API Key overrides
+    @AppStorage("dev_deepgram_api_key") private var devDeepgramKey: String = ""
+    @AppStorage("dev_gemini_api_key") private var devGeminiKey: String = ""
+    @AppStorage("dev_anthropic_api_key") private var devAnthropicKey: String = ""
+
     init(
         appState: AppState,
         selectedSection: Binding<SettingsSection>,
@@ -2513,6 +2520,8 @@ struct SettingsContentView: View {
             troubleshootingSubsection
             advancedCategoryHeader(title: "Gmail Reader", icon: "envelope.fill")
             gmailReaderSubsection
+            advancedCategoryHeader(title: "Developer API Keys", icon: "key")
+            developerKeysSubsection
         }
     }
 
@@ -4102,6 +4111,79 @@ struct SettingsContentView: View {
         return formatter
     }
 
+    // MARK: - Developer API Keys Subsection
+
+    private var developerKeysSubsection: some View {
+        VStack(spacing: 20) {
+            settingsCard(settingId: "advanced.devkeys.info") {
+                HStack(spacing: 12) {
+                    Image(systemName: "info.circle")
+                        .foregroundColor(OmiColors.textTertiary)
+                    Text("Override backend-provided API keys with your own. Leave blank to use default keys.")
+                        .scaledFont(size: 13)
+                        .foregroundColor(OmiColors.textTertiary)
+                    Spacer()
+                }
+            }
+
+            developerKeyField(
+                title: "Deepgram API Key",
+                subtitle: "For transcription",
+                settingId: "advanced.devkeys.deepgram",
+                value: $devDeepgramKey
+            )
+
+            developerKeyField(
+                title: "Gemini API Key",
+                subtitle: "For proactive AI (memory, tasks, advice, focus)",
+                settingId: "advanced.devkeys.gemini",
+                value: $devGeminiKey
+            )
+
+            developerKeyField(
+                title: "Anthropic API Key",
+                subtitle: "For chat (Claude)",
+                settingId: "advanced.devkeys.anthropic",
+                value: $devAnthropicKey
+            )
+
+            if !devDeepgramKey.isEmpty || !devGeminiKey.isEmpty || !devAnthropicKey.isEmpty {
+                settingsCard(settingId: "advanced.devkeys.clear") {
+                    HStack {
+                        Spacer()
+                        Button(action: {
+                            devDeepgramKey = ""
+                            devGeminiKey = ""
+                            devAnthropicKey = ""
+                        }) {
+                            Text("Clear All Custom Keys")
+                                .scaledFont(size: 13, weight: .medium)
+                                .foregroundColor(.red)
+                        }
+                        .buttonStyle(.plain)
+                        Spacer()
+                    }
+                }
+            }
+        }
+    }
+
+    private func developerKeyField(title: String, subtitle: String, settingId: String, value: Binding<String>) -> some View {
+        settingsCard(settingId: settingId) {
+            VStack(alignment: .leading, spacing: 8) {
+                Text(title)
+                    .scaledFont(size: 14, weight: .medium)
+                    .foregroundColor(OmiColors.textPrimary)
+                Text(subtitle)
+                    .scaledFont(size: 12)
+                    .foregroundColor(OmiColors.textTertiary)
+                SecureField("Leave blank for default", text: value)
+                    .textFieldStyle(.roundedBorder)
+                    .scaledFont(size: 13)
+            }
+        }
+    }
+
     private func tierPickerRow(tier: Int, label: String, subtitle: String) -> some View {
         let isSelected = currentTierLevel == tier
         return Button(action: {

desktop/Desktop/Sources/OmiApp.swift

@@ -315,6 +315,11 @@ class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
             // Fetch conversations on startup
             AuthService.shared.fetchConversations()
 
+            // Fetch API keys from backend (keys are not bundled in the app)
+            Task {
+                await APIKeyService.shared.fetchKeys()
+            }
+
             // Check tier eligibility (at most once per day)
             Task {
                 await TierManager.shared.checkTierIfNeeded()