Thanks for the incredible feedback, Cai! I'm really glad you liked the realestate appraisal example.
You hit the nail on the head regarding production security. Embedding static API keys on the client-side is definitely a ticking time bomb for unexpected bills and leaks once you start scaling past a handful of users.
Using a lightweight proxy layer or leverage environment-level secrets management is absolutely the right way to handle this securely in production. I'll definitely look into expanding on this or adding a dedicated section about secure authentication and OAuth flows in my upcoming guides to make it more foolproof for builders.
Appreciate you bringing this up—insights like this make the community discussions so valuable! 🙌
Great comprehensive guide, Ketan. The real estate appraisal example really brings the concepts together. One area that deserves more attention is how you handle API keys and authentication in production for these no-code apps. The article mentions keeping API keys confidential, but in practice, embedding them in Bubble workflows or FlutterFlow API connectors means they are accessible to anyone who inspects the client-side code. For production multimodal apps that call paid APIs, you also need to think about rate limiting, cost tracking, and user attribution. A single API key shared across all users can get rate-limited fast or generate unexpected bills. Consider adding a lightweight proxy layer or using environment-level secrets management in each platform. For apps that need per-user authentication, OAuth flows with token exchange are much more secure than embedding static keys. It adds a few steps to the setup but saves a lot of headaches when you scale past the first hundred users.