Your API Key Doesn't Belong in the App

let model = ClaudeLanguageModel(
  name: .opus4_8,
  auth: .apiKey(ProcessInfo.processInfo.environment["ANTHROPIC_API_KEY"] ?? "")
)
let session = LanguageModelSession(model: model)
let response = try await session.respond(to: "Plan a 4-day trip to Buenos Aires.")

/**
 * Backend-for-Frontend (BFF) Cloudflare Worker — an in-app-purchase-gated
 * Claude proxy.
 *
 * EXAMPLE CODE. Not deployed. Placeholders only — no real keys, bundle IDs,
 * account IDs, or Worker URLs. See README.md.
 *
 * Flow:
 *   1. The app sends a StoreKit 2 signed transaction (JWS) in the
 *      X-IAP-Transaction header, alongside a standard Anthropic Messages API
 *      request body.
 *   2. This Worker verifies the JWS against Apple's certificate chain, checks
 *      the transaction's bundleId against an allowlist, and confirms the
 *      entitlement is current (not revoked, not expired). A free trial is just
 *      a subscription with a future expiresDate, so one check covers both.
 *   3. On success it injects the Anthropic API key server-side and forwards the
 *      request to https://api.anthropic.com. The app ships no key.
 */

export interface Env {
  /** Anthropic API key. Set as a secret: `wrangler secret put ANTHROPIC_API_KEY`. */
  ANTHROPIC_API_KEY: string;
  /** Comma-separated allowlist of app bundle IDs, e.g. "com.example.app". */
  ALLOWED_BUNDLE_IDS: string;
  /** Comma-separated allowlist of product IDs. Empty/unset = accept any product. */
  ALLOWED_PRODUCT_IDS?: string;
  /** Hex SHA-256 of the DER-encoded "Apple Root CA - G3" certificate.
   *  Obtain and verify from https://www.apple.com/certificateauthority/ */
  APPLE_ROOT_CA_SHA256: string;
  /** Anthropic API version header. Defaults to "2023-06-01". */
  ANTHROPIC_VERSION?: string;
}

const ANTHROPIC_BASE = "https://api.anthropic.com";
const TRANSACTION_HEADER = "X-IAP-Transaction";
const DEFAULT_ANTHROPIC_VERSION = "2023-06-01";

/** The decoded StoreKit 2 transaction fields this gate cares about. */
export interface JWSTransaction {
  bundleId?: string;
  productId?: string;
  /** Subscription expiry, ms since epoch. Absent for non-subscription products. */
  expiresDate?: number;
  /** Set (ms since epoch) when Apple revokes the purchase (refund, dispute). */
  revocationDate?: number;
}

export interface GateConfig {
  allowedBundleIds: Set<string>;
  allowedProductIds: Set<string> | null; // null = any product
  now: number; // ms since epoch
}

export type GateResult =
  | { ok: true }
  | { ok: false; status: 401 | 403; reason: string };

/** Parse a comma-separated env var into a trimmed, non-empty Set. */
export function parseList(value: string | undefined): Set<string> {
  return new Set(
    (value ?? "")
      .split(",")
      .map((s) => s.trim())
      .filter((s) => s.length > 0),
  );
}

/**
 * Pure entitlement decision — no crypto, no network. Given a decoded
 * transaction and the gate config, decide whether the caller is entitled.
 */
export function evaluateEntitlement(
  txn: JWSTransaction,
  cfg: GateConfig,
): GateResult {
  if (!txn.bundleId || !cfg.allowedBundleIds.has(txn.bundleId)) {
    return { ok: false, status: 403, reason: "bundle_id_not_allowed" };
  }
  if (
    cfg.allowedProductIds &&
    (!txn.productId || !cfg.allowedProductIds.has(txn.productId))
  ) {
    return { ok: false, status: 403, reason: "product_id_not_allowed" };
  }
  if (txn.revocationDate != null) {
    return { ok: false, status: 403, reason: "entitlement_revoked" };
  }
  // Trial and paid are the same check: a subscription is valid while its
  // expiresDate is in the future. Non-subscription products omit expiresDate.
  if (txn.expiresDate != null && txn.expiresDate <= cfg.now) {
    return { ok: false, status: 403, reason: "entitlement_expired" };
  }
  return { ok: true };
}

/** Verifier signature, so tests can swap in a fake and skip real certificates. */
export type TransactionVerifier = (
  jws: string,
  appleRootSha256: string,
) => Promise<JWSTransaction>;

/**
 * Verify a StoreKit 2 signed transaction:
 *   - the x5c chain is internally consistent (leaf <- intermediate <- root),
 *   - the root's SHA-256 matches the pinned Apple Root CA - G3, and
 *   - the JWS is signed by the leaf certificate.
 *
 * Dependencies are imported lazily so the pure logic above is unit-testable
 * with zero installs. Production dependencies: `jose`, `@peculiar/x509`.
 */
export const verifyTransactionJWS: TransactionVerifier = async (
  jws,
  appleRootSha256,
) => {
  const { decodeProtectedHeader, importX509, jwtVerify } = await import("jose");
  const x509 = await import("@peculiar/x509");

  const header = decodeProtectedHeader(jws);
  const x5c = header.x5c;
  if (!Array.isArray(x5c) || x5c.length < 2) {
    throw new Error("JWS is missing an x5c certificate chain");
  }

  // Verify each link in the chain (leaf first, root last).
  const certs = x5c.map((der) => new x509.X509Certificate(der));
  for (let i = 0; i < certs.length - 1; i++) {
    const issuerKey = await certs[i + 1].publicKey.export();
    if (!(await certs[i].verify({ publicKey: issuerKey }))) {
      throw new Error("broken certificate chain");
    }
  }

  // Pin the trust anchor: the root must be Apple Root CA - G3.
  const root = certs[certs.length - 1];
  const rootSha256 = toHex(await crypto.subtle.digest("SHA-256", root.rawData));
  if (rootSha256 !== normalizeHex(appleRootSha256)) {
    throw new Error("untrusted root certificate");
  }

  // Verify the JWS signature with the leaf certificate's public key.
  const leafKey = await importX509(certs[0].toString("pem"), "ES256");
  const { payload } = await jwtVerify(jws, leafKey);
  return payload as JWSTransaction;
};

function toHex(buf: ArrayBuffer): string {
  return [...new Uint8Array(buf)]
    .map((b) => b.toString(16).padStart(2, "0"))
    .join("");
}

function normalizeHex(s: string): string {
  return s.toLowerCase().replace(/[^0-9a-f]/g, "");
}

/**
 * Core request handler. The verifier is injectable so tests can exercise the
 * gate-and-proxy flow without real Apple certificates.
 */
export async function handleRequest(
  request: Request,
  env: Env,
  verify: TransactionVerifier = verifyTransactionJWS,
): Promise<Response> {
  if (request.method !== "POST") {
    return new Response("method not allowed", { status: 405 });
  }

  const jws = request.headers.get(TRANSACTION_HEADER);
  if (!jws) {
    return json(401, { error: "missing in-app purchase transaction" });
  }

  let txn: JWSTransaction;
  try {
    txn = await verify(jws, env.APPLE_ROOT_CA_SHA256);
  } catch {
    // Bad signature, broken chain, or untrusted root — reject without detail.
    return json(401, { error: "invalid in-app purchase transaction" });
  }

  const gate = evaluateEntitlement(txn, {
    allowedBundleIds: parseList(env.ALLOWED_BUNDLE_IDS),
    allowedProductIds: env.ALLOWED_PRODUCT_IDS
      ? parseList(env.ALLOWED_PRODUCT_IDS)
      : null,
    now: Date.now(),
  });
  if (!gate.ok) {
    return json(gate.status, { error: gate.reason });
  }

  // Entitled. Inject the secret server-side and forward to Anthropic.
  const incoming = new URL(request.url);
  const target = ANTHROPIC_BASE + incoming.pathname + incoming.search;

  const headers = new Headers(request.headers);
  headers.delete(TRANSACTION_HEADER); // never forward the app token upstream
  headers.delete("host");
  headers.set("x-api-key", env.ANTHROPIC_API_KEY);
  headers.set(
    "anthropic-version",
    env.ANTHROPIC_VERSION ?? DEFAULT_ANTHROPIC_VERSION,
  );

  return fetch(target, {
    method: request.method,
    headers,
    body: request.body,
    // @ts-expect-error duplex is required when streaming a request body
    duplex: "half",
  });
}

function json(status: number, body: unknown): Response {
  return new Response(JSON.stringify(body), {
    status,
    headers: { "content-type": "application/json" },
  });
}

export default {
  fetch(request: Request, env: Env): Promise<Response> {
    return handleRequest(request, env);
  },
};

[vars]
ALLOWED_BUNDLE_IDS = "com.example.app"
APPLE_ROOT_CA_SHA256 = "<pinned fingerprint>"

wrangler secret put ANTHROPIC_API_KEY

// App-side helper for talking to Claude through an IAP-gated
// Backend-for-Frontend (BFF) Worker.
//
// EXAMPLE CODE. Placeholders only — point `baseURL` at your own Worker.
// Requires Xcode 27 / OS 27 betas and the ClaudeForFoundationModels package.

import Foundation
import StoreKit
import FoundationModels
import ClaudeForFoundationModels

// A caseless `enum` is Swift's idiomatic namespace: it groups the static
// members below and cannot be instantiated (unlike a `struct`, which can).
enum ClaudeBFF {
    /// The BFF endpoint. Point this at your deployed Worker.
    static let baseURL = URL(string: "https://bff.example.com/claude")!

    /// Header the BFF reads the signed transaction from.
    static let transactionHeader = "X-IAP-Transaction"

    enum EntitlementError: Error {
        case noActiveEntitlement
    }

    /// The user's current entitlement as a signed JWS, if one is active.
    /// A free trial and a paid subscription both surface here while active, so
    /// the app doesn't distinguish them — the BFF makes the final decision and
    /// re-verifies the signature server-side.
    static func currentEntitlementJWS() async throws -> String {
        for await result in Transaction.currentEntitlements {
            // Forward the signed representation as-is. We don't treat the
            // device's own verification as the gate — the server does.
            return result.jwsRepresentation
        }
        throw EntitlementError.noActiveEntitlement
    }

    /// Headers sent to the BFF. The app ships no API key; this header is how the
    /// Worker authorizes the caller before injecting the real credential.
    static func proxyHeaders(jws: String) -> [String: String] {
        [transactionHeader: jws]
    }

    /// A Claude model that routes through the BFF using `.proxied` auth.
    static func model(
        _ name: ClaudeModel = .opus4_8,
        jws: String
    ) -> ClaudeLanguageModel {
        ClaudeLanguageModel(
            name: name,
            auth: .proxied(headers: proxyHeaders(jws: jws)),
            baseURL: baseURL
        )
    }

    /// Convenience: fetch the entitlement, build a session, and respond.
    static func respond(to prompt: String) async throws -> String {
        let jws = try await currentEntitlementJWS()
        let session = LanguageModelSession(model: model(jws: jws))
        let response = try await session.respond(to: prompt)
        return response.content
    }
}