# Server-side proxy pattern

## Flow

Server-side proxy

```
Browser
  -> POST /api/product-feature
  -> validate product user and tenant
  -> map feature_key to harness_id
  -> call HarnessRouter with HR_API_KEY
  -> return product-shaped stream or JSON
```

## Why

- Keeps the HarnessRouter API key out of the browser.
- Lets the product enforce user and tenant ownership.
- Allows the product to sanitize progress events and generated previews.
- Preserves one stable UI contract even if the configured agent changes.

**Open standard**  
Putting your backend between the browser and HarnessRouter places it in the Client role of UHP's architecture — the application that wants work done, which the spec itself says can be a product backend. See [roles in the UHP Architecture chapter](https://unifiedharnessprotocol.org/spec/architecture).  
[Create API Key →](https://app.harnessrouter.ai/quickstart?ref=docs-create-api-key)

Ready to run this against a live workspace? Keys take under a minute.