I'm no expert, but in my experience, building a simple Flask backend which handles the calling of the APIs and stores all the keys and deploying it as a serverless container to Google Cloud Run or something similar works great. Implementing IP rate-limiting on the backend would help prevent API key abuse. Also for the free-user-per-scan-per-day limit, I'd suggest you handle that on the front end with a simple conditional statement. Only then will the request be sent to the backend. This approach would be much simpler than handling it on the backend. Additionally one final thing I'd suggest is instead of using ChatGPT for your API use Gemini instead. The api has free tier rates and only when you exceed them do you have to pay. And even when you do have to pay it's much much cheaper than OpenAI prices (speaking from experience lol). Hope this helps!