Introducing Cartly: An iOS Receipt Tracking App Built on Mnexium
by•
We just published a new case study on Cartly, an iOS app that uses Mnexium to power a full receipt-tracking AI workflow. We really wanted to see what it would take to get a demo like this up and running.
In the post, we walk through how Cartly uses:
Memory for user preferences and continuity
Records for structured receipts and receipt_items storage
A single mnx runtime object to control identity, history, recall, and record sync
Request trace packets for auditability and debugging in production
The demo flow covers schema setup, receipt image capture, AI extraction, record persistence, and record-aware chat responses.
Blog: https://mnexium.com/blogs/introducing-cartly
Docs: https://mnexium.com/docs
iOS code: https://github.com/mnexium/cartly
45 views
Replies
Seems like Mnexum is a good tool for indie developers who are trying to adopt their vibecoded apps to using AI without additional efforts. But the first question is: could I use it directly from my mobile app and store my API key for Claude or OpenAI in this platform or should I build my own backend and authorization system and then use it instead of handling my own database?
Mnexium AI
@valentina_konuhova
Honestly, this is more of a platform constraint than a Mnexium-specific issue. Even without Mnexium, Apple strongly advises not embedding API keys directly inside a shipped iOS application. The same guidance applies whether you’re using OpenAI, Anthropic, or Mnexium. Wherever you’d store one API key, you’d store the others.
The recommended (and most common) approach is to host API keys outside the iOS app, typically behind a backend service (for example, a Lambda or API endpoint). The app then communicates with that service once it starts up. This is simply how Apple expects sensitive credentials to be handled today.
It would definitely be easier if iOS supported something like a true .env file for apps, but at the moment there isn’t one. The Keychain is usually suggested, but the key still has to be securely delivered there in the first place.
Hope this helps. happy to go deeper or clarify anything if useful.