About MyAppToken
Infrastructure for apps that call paid APIs directly.
The product
MyAppToken is a reverse proxy for mobile and frontend applications that call provider APIs — OpenAI, Gemini, Replicate, fal.ai, or any Bearer-auth HTTP API — without a backend of their own. Your provider key is stored server-side and injected into requests by the proxy; your app authenticates its users with short-lived JWTs and keeps using the provider's native API. The integration is a base-URL swap.
Around that core sit the controls a backend would normally give you: per-user rate limits and analytics, one-click abuse response, key rotation without an app release, and Firebase App Check verification for genuine app builds.
The mission
Let app developers ship features built on paid APIs with the security of a backend — without building or operating one. Embedding a provider key in an app binary means it gets extracted and drained; running a proxy backend means weeks of work plus ongoing operations. MyAppToken exists to make the secure path the easy path.
The philosophy
- Transparent passthrough, not an abstraction layer. You keep each provider's native API. No SDK, no unified schema, no lock-in surface.
- Honesty over marketing. The site states what the product does not do yet — buffered responses, the simple-auth threat model, beta limits — in the same place it makes its claims. Every technical statement on these pages is checked against the implementation before it ships.
- Your data is yours. Traffic logs are visible only to your account, exportable as CSV, and deleted with your account.
- Minimal surface area. One job — keep provider keys out of client binaries — done precisely, in preference to a broad platform done vaguely.
The engineering approach
MyAppToken runs on AWS (us-east-1): a small, boring, observable stack — services written in Clojure, DynamoDB for state, S3 and Athena for analytics, CloudFront in front, all managed with Terraform. Provider keys are encrypted at rest and masked from the moment they are saved; upstream base URLs must be HTTPS; the request path is logged end-to-end so per-user statistics and abuse controls are built on real data, not sampling guesses.
The same discipline applies to what we publish: the docs are verified against the running API, the security model is described as it is — including its current limits — and the status page says plainly that beta has no SLA yet.
Questions, security reports, or anything else: hello@myapptoken.com.