docs/guides/using-ai.mdx
<Info>
<strong>Your credentials and AI configuration are never saved on Reactive Resume servers.</strong> They only live in your device's browser storage.
</Info>
However, whenever you use an AI-assisted feature (such as text generation), these credentials need to be sent to the server **temporarily and only for the duration of your request**. This is required to connect with the AI provider on your behalf. See below for a deeper explanation.
- **OpenAI**
- **Google Gemini**
- **Anthropic Claude**
- **Ollama** (coming soon)
<Warning>
Treat this key like a password. Anyone with it can use your provider account and may incur costs.
</Warning>
<Tip>
If the status shows <Badge>Disabled</Badge>, double-check that all three fields are filled in.
</Tip>
Most AI providers (like OpenAI, Gemini, or Anthropic) block requests that come directly from the browser due to something called CORS ("Cross-Origin Resource Sharing"), a security mechanism built into web browsers.
What is CORS?
CORS is a browser feature that prevents web pages from making requests to a different domain than the one that served the web page, unless that domain explicitly allows it. Most AI providers do not allow browser-based requests from random websites, primarily for security and abuse prevention.
Because of this restriction, the app has to forward your AI requests (along with your credentials) through our server, which then contacts the AI provider and returns the response to your browser. Your credentials are not stored on our server; they are only used to make the request you initiated, and are not logged or retained.
<Info> If you're curious or would like to audit how your AI requests are forwarded, you can review the code yourself. See the relevant implementation in <code>src/integrations/orpc/router/ai.ts</code> within the codebase. </Info>If you have a solution or workaround for this CORS-related limitation, please consider raising an issue or pull request on GitHub.