How to add the Replicate API to an iOS app

What Replicate does for an iOS app

Replicate gives you one API in front of thousands of models you would otherwise have to host yourself, from text-to-image to upscaling to audio. You create a prediction with a model version and inputs, the model runs on Replicate's hardware, and you get the output back, often as a URL to a generated image. For an iOS app this means you can add generative features without GPUs or model ops. The work that matters is keeping the token off the device and handling the async nature of predictions, which complete in seconds to minutes.

Adding Replicate with AppFlight

Replicate authenticates with a single token that has full power over your account, so it is a backend secret, never a client key. In AppFlight you add the Replicate token, and AppFlight stores it in the backend secrets of your own Supabase, not in the app. It generates a Supabase edge function that takes a prompt from the app, calls Replicate with the token, waits for the prediction, and returns the result. The app talks only to that function. This is the client versus backend split: nothing secret is ever in the binary.

A SwiftUI example

The app calls your backend, which holds the token and talks to Replicate:

struct GenerateResponse: Decodable { let imageURL: String }

func generateImage(prompt: String) async throws -> URL {
    var request = URLRequest(
        url: URL(string: "https://your-project.supabase.co/functions/v1/generate")!
    )
    request.httpMethod = "POST"
    request.setValue("application/json", forHTTPHeaderField: "Content-Type")
    request.httpBody = try JSONEncoder().encode(["prompt": prompt])

    let (data, _) = try await URLSession.shared.data(for: request)
    let result = try JSONDecoder().decode(GenerateResponse.self, from: data)
    return URL(string: result.imageURL)!
}

The backend function is where the secret lives. In outline, it reads REPLICATE_API_TOKEN from the environment, sends a POST to https://api.replicate.com/v1/predictions with an Authorization: Bearer header and the model inputs, polls until the prediction status is succeeded, and returns the output URL to the app. The token never leaves the server.

Alternatives

If you only need text or chat, the OpenAI or Claude APIs follow the same backend pattern with less moving parts than running arbitrary models. For on-device generation with no network and no token, Core ML can run smaller models locally, though quality and size are limited. Replicate is the strongest choice when you want access to many large hosted models, especially image and video, without operating the infrastructure yourself.