外部APIを使う静的サイトでAPIキーを隠す：PHPで「薄いプロキシAPI」を挟む構成のサンプル

/public
　/api/chat.php
/.env
/vendor

OPENAI_API_KEY=sk-xxxxxxxxxxxxxxxx

<?php
require_once __DIR__ . '/../../vendor/autoload.php';

Dotenv\Dotenv::createImmutable(__DIR__ . "/../..")->load();

header("Content-Type: application/json; charset=utf-8");

// フロントからの入力を取得
$body = file_get_contents("php://input");
if ($body === false || $body === '') {
    http_response_code(400);
    echo json_encode(["error" => "empty request body"]);
    exit;
}

// APIキー取得
$apiKey = $_ENV['OPENAI_API_KEY'] ?? '';
if ($apiKey === '') {
    http_response_code(500);
    echo json_encode(["error" => "API key not set"]);
    exit;
}

// chatGPT API にそのまま中継
$ch = curl_init("https://api.openai.com/v1/chat/completions");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST => true,
    CURLOPT_HTTPHEADER => [
        "Content-Type: application/json",
        "Authorization: Bearer {$apiKey}",
    ],
    CURLOPT_POSTFIELDS => $body,
    CURLOPT_TIMEOUT => 30,
]);

$response = curl_exec($ch);

if ($response === false) {
    http_response_code(502);
    echo json_encode(["error" => curl_error($ch)]);
    curl_close($ch);
    exit;
}

$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// chatGPTのレスポンスをそのまま返す
http_response_code($httpCode);
echo $response;

// 送信の作成
const payload = {
  model: "gpt-4o-mini",
  messages: [
    { role: "system", content: "必ずJSONのみ返してください。" },
    { role: "user", content: "こんにちは。" }
  ],
  temperature: 0
};

// 送信と受信
const res = await fetch("/api/chat.php", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify(payload)
});

// 受信物
const data = await res.json();
console.log(data);