Keep your API key in Replit Secrets
Store your Bird API key in Replit Secrets so credentials stay on the server and out of browser bundles. Your frontend calls your Replit backend route, and your backend calls Bird to send OTP codes, receipts, and alerts.