Ask a question — the request is routed through an app-owned server function that calls OpenRouter, so the API key never reaches the browser.