Production Considerations
What to set up before real users start using AI in your editor.
emend gives you the editor AI features. It does not host anything, handle sign-in, or save data for you. Before you go live, set up the items below using the systems your app already has.
Keep your API key on the server
Put your AI provider key in a server-only environment variable. Never put it in
a NEXT_PUBLIC_* variable, a component prop, browser storage, or the component
files. All of those end up in the browser, where anyone can copy the key and
use it to run up your AI bill or abuse your account.
Check who is making each request
The server route cannot tell who is allowed to read or edit a document. Use the
handler's authorize option to check the signed-in user and their access to
the document before the AI model is called. If the check fails, do not send any
document text to the provider.
Limit how often people can use AI
Add rate limits per user or workspace, before the AI model is called. Tell users clearly when they can try again. Log enough to spot abuse, but do not log full documents unless you need to.
Decide where things are saved
emend does not save documents, suggestions, or chats.
- Save your documents as Tiptap JSON in your own database, as you do today.
- The AI Assistant saves chats in the browser's
localStorage. This is not encrypted, and any script on your site can read it. Do not use it for passwords, secrets, or sensitive documents.
Always let people review AI changes
Do not apply AI suggestions automatically. People should always see what will change, and be able to accept, reject, or undo it.
Keep the components accessible
If you change the component files, keep these working:
- Real
<button>and<a>elements. - Labels on icon-only buttons.
- A visible focus outline.
- Keyboard access to every action.
- Screen reader announcements for loading and errors.
Also check your final page at 320 px wide and at 200% zoom.
Before you go live
Make sure everything below is set up and working before real users start using AI in your app.
- The API key is only on the server.
- The route checks sign-in, document access, and rate limits.
- Request and response size limits fit your AI plan.
- Documents and chat history are saved and deleted according to your own rules.
- Questions, edits, Accept, Reject, out-of-date suggestions, and Undo all work with your real editor extensions.
- Keyboard use, mobile layout, light and dark themes, and error messages all work.
See Troubleshooting and Limitations if something is not working.