Connect to a backend api that does the requests to OpenAi. Setup CORS to prevent embedding on other sites. And remember your api is still completely unauthenticated so add rate limiting and a block list to limit abuse.