AIProxy can now protect gRPC calls, including full bidirectional streaming. You can keep using the client and generated protobuf types you already have, while AIProxy keeps the provider credential out of your shipped app and applies your project's existing protection rules.

Bring your existing gRPC client

AIProxySwift does not need to understand your protobuf schema and does not add a dependency on a particular gRPC package. Point your existing transport at the AIProxy service URL, then use AIProxy.grpcMetadata to attach the project, service, partial-key, client, and DeviceCheck values needed by the proxy.

The README includes a complete example using Apple's grpc-swift packages, but the metadata contract can be used with another client as well.

The same controls, on a different transport

gRPC requests use the same project lookup, key decryption, DeviceCheck, endpoint, and rate-limit machinery as HTTP and WebSocket requests. AIProxy removes its routing metadata before forwarding the call and injects the decrypted provider key only on the upstream connection.

Upstream gRPC status and message trailers are passed back to the app. If AIProxy rejects a call, it responds with standard gRPC statuses such as UNAUTHENTICATED, PERMISSION_DENIED, RESOURCE_EXHAUSTED, or UNAVAILABLE, so existing client error handling continues to make sense.

Designed for streaming workloads

The proxy supports multiplexed HTTP/2 streams, flow control, client cancellation, async authorization, bounded buffering while authorization completes, and upstream failure handling. Unary, server-streaming, client-streaming, and bidirectional calls all travel through the same protected connection.

See the gRPC example in AIProxySwift to protect an existing call.