Next.js is the recommended framework for building production Polpo apps. Use Server Components for secure API calls and Client Components for real-time UI.
Install
Environment variables
Keep POLPO_API_KEY server-side only (no NEXT_PUBLIC_ prefix). Use a route handler to proxy authenticated requests.
Server-side: Route Handler
Create an API route that proxies chat completions with the API key injected server-side:
Server-side: Server Components
Fetch agent data directly in Server Components — no client-side API key exposure:
Client-side hooks through a proxy
Point PolpoProvider at an application-owned proxy. Do not pass the project URL or key through a Server Component: serialized props are still visible to the browser. The proxy must inject POLPO_API_KEY and forward /v1 resource routes.
Native browser EventSource cannot add the Cloud authorization header. Implement /api/events as an authenticated SSE proxy before enabling autoConnect.
Pattern: Secure chat proxy
The recommended pattern for production chat apps:
This keeps the API key server-side while streaming responses to the browser.
Templates
Get started faster with pre-built templates. Browse all available templates at ui.polpo.sh/examples — these are also available in the polpo create wizard.