The split
Client code runs on the user’s device: the browser or a mobile app. Server code runs on machines you control. Anything in the client can be read and changed by the person using it, so the split is a security decision as much as a performance one.
Keep on the server
These belong behind a server boundary:
- API keys and credentials for AI models and business systems.
- Permission checks: who may read or change what.
- Calls that cost money or act on someone’s behalf.
- Anything that must be logged or approved.
Good fits for the client
Rendering, instant feedback, input validation for convenience (repeated on the server), and work that should stay on the device for privacy, such as some on-device vision.