gregyoung14:
Update: Downloaded Charles Proxy on my Mac. Setup an HTTP Proxy, forwarded all my iPhone Traffic through it, and Downloaded the Charles Proxy SSL Cert, gave it root access on my iPhone, and was able to decrypt the HTTPS request from my iPhone. Took 10 minutes. In plain text, was my Authentication Header containing the full API Key. No library on GitHub that talks to the OpenAI API directly from any non-authenticated Front End Client (Web, Mobile, etc) is safe. Embarrassing I forgot how easy this was to do, but lesson learned.
gregyoung14, how did you go about mitigating this? Did you go with an APIGateway or? If you can point to things you did to address this it would be appreciated!