What is Server?

A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.

Where Server goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

The life of a click · 4 minutes · Free
The save that saved nothing
A user clicks Save on their profile. A green 'Saved!' appears. When they reload, their changes are gone.
Why does my app say saved when the save failed?
fetch only throws on network failures, not on HTTP errors. A 500 response still resolves, so code that shows a success message right after await fetch() reports success even when the server failed. Check response.ok, and show the error when it is false.
Walk it, free
Don't trust the browser · 4 minutes · Free
The $1 Pro plan
Your Pro plan costs $49 a year. Stripe shows three new Pro customers this morning who each paid $1.
Can users change the price at checkout?
Yes, if your server takes the amount or price ID from the browser. Anything the browser sends can be edited, so a visitor can create a checkout at any price. Send only which plan the visitor wants, and have the server look up the allowed price from its own list before creating the Stripe checkout.
Walk it, free
Don't trust the browser · 4 minutes · Pro
Minus three tickets
A customer bought minus three concert tickets. Your app 'charged' them -$60 and added $60 of store credit to their wallet.
Is form validation enough to secure my API?
No. Form rules like required, min and max run in the browser for the honest user's convenience, but anyone can send the request directly with any values. Validate every field on the server, checking type, range, length and allowed values with a schema library like Zod, and add database constraints as a last line of defence.
Read the fix
Money and secrets · 4 minutes · Free
The key in the bundle
Your OpenAI bill jumped from $40 to $3,900 overnight. Your app has 60 users.
Is my API key exposed in my frontend code?
If the key is in a variable with a public prefix such as NEXT_PUBLIC_, VITE_ or EXPO_PUBLIC_, or used in client code, it is in your JavaScript bundle and anyone can copy it. Revoke the key, create a new one, and call the paid API from your server only.
Walk it, free
Keeping it running · 4 minutes · Free
The error nobody saw
Sign-ups halved this week. No alert, no error on your screen. Then a customer writes: 'your form just says Something went wrong'.
Why don't I see errors my users see?
Many AI-built apps catch errors and show a generic message without recording the real error anywhere. Errors in the visitor's browser never reach your server logs on their own. Add an error tracking tool such as Sentry to both the browser and the server, with alerts, so you hear about failures before customers write in.
Walk it, free
Into the app stores · 4 minutes · Free
The key inside the app
Your phone app went live on Friday. By Monday your OpenAI bill is $2,300, and the usage page shows requests your app never makes.
Can people see API keys in my Expo app?
Yes. Expo copies every EXPO_PUBLIC_ variable into the JavaScript inside your app, and anyone can download the app and read it. Public keys like the Supabase anon key are fine there. Secret keys for OpenAI, Stripe or other paid services must stay on a server function that your app calls instead.
Walk it, free

Request: A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
API: The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.
Browser: Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.
Endpoint: One specific address on your server that does one job, like /api/invoices. Each one needs its own safety checks.
Database: Where your app keeps its data, organised in tables, like a set of spreadsheets.
Authentication: Checking who someone is, usually by signing in.

All 62 terms in the glossary

Where Server goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

The life of a click · 4 minutes · Free

The save that saved nothing

A user clicks Save on their profile. A green 'Saved!' appears. When they reload, their changes are gone.

Why does my app say saved when the save failed?

fetch only throws on network failures, not on HTTP errors. A 500 response still resolves, so code that shows a success message right after await fetch() reports success even when the server failed. Check response.ok, and show the error when it is false.

Walk it, free

Don't trust the browser · 4 minutes · Free

The $1 Pro plan

Your Pro plan costs $49 a year. Stripe shows three new Pro customers this morning who each paid $1.

Can users change the price at checkout?

Yes, if your server takes the amount or price ID from the browser. Anything the browser sends can be edited, so a visitor can create a checkout at any price. Send only which plan the visitor wants, and have the server look up the allowed price from its own list before creating the Stripe checkout.

Walk it, free

Don't trust the browser · 4 minutes · Pro

Minus three tickets

A customer bought minus three concert tickets. Your app 'charged' them -$60 and added $60 of store credit to their wallet.

Is form validation enough to secure my API?

No. Form rules like required, min and max run in the browser for the honest user's convenience, but anyone can send the request directly with any values. Validate every field on the server, checking type, range, length and allowed values with a schema library like Zod, and add database constraints as a last line of defence.

Read the fix

Money and secrets · 4 minutes · Free

The key in the bundle

Your OpenAI bill jumped from $40 to $3,900 overnight. Your app has 60 users.

Is my API key exposed in my frontend code?

If the key is in a variable with a public prefix such as NEXT_PUBLIC_, VITE_ or EXPO_PUBLIC_, or used in client code, it is in your JavaScript bundle and anyone can copy it. Revoke the key, create a new one, and call the paid API from your server only.

Walk it, free

Keeping it running · 4 minutes · Free

The error nobody saw

Sign-ups halved this week. No alert, no error on your screen. Then a customer writes: 'your form just says Something went wrong'.

Why don't I see errors my users see?

Many AI-built apps catch errors and show a generic message without recording the real error anywhere. Errors in the visitor's browser never reach your server logs on their own. Add an error tracking tool such as Sentry to both the browser and the server, with alerts, so you hear about failures before customers write in.

Walk it, free

Into the app stores · 4 minutes · Free

The key inside the app

Your phone app went live on Friday. By Monday your OpenAI bill is $2,300, and the usage page shows requests your app never makes.

Can people see API keys in my Expo app?

Yes. Expo copies every EXPO_PUBLIC_ variable into the JavaScript inside your app, and anyone can download the app and read it. Public keys like the Supabase anon key are fine there. Secret keys for OpenAI, Stripe or other paid services must stay on a server function that your app calls instead.

Walk it, free

Related terms

Request

A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

API

The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.

Browser

Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.

Endpoint

One specific address on your server that does one job, like /api/invoices. Each one needs its own safety checks.

Database

Where your app keeps its data, organised in tables, like a set of spreadsheets.

Authentication

Checking who someone is, usually by signing in.