Laravel integration

Use Laravel's HTTP client from a server controller and keep the key in configuration.

In a fresh Laravel application set METAPHRASE_API_KEY in private .env. Add this entry to the array returned by config/services.php, preserving your other service settings:

'metaphrase' => [
    'key' => env('METAPHRASE_API_KEY'),
    'base_url' => env('METAPHRASE_BASE_URL', 'https://metaphrase.msalman.com'),
],

Save as app/Http/Controllers/MetaPhraseController.php:

<?php
namespace App\Http\Controllers;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Http;
class MetaPhraseController extends Controller {
    public function paraphrase(Request $request) {
        $data = $request->validate(['text'=>['required','string','max:20000']]);
        $key = config('services.metaphrase.key');
        if (!$key) return response()->json(['error'=>['message'=>'The backend key is not configured.']],503);
        try {
            $result = Http::withToken($key)->acceptJson()->timeout(250)
                ->post(rtrim(config('services.metaphrase.base_url'),'/').'/api/v1/paraphrase',[
                    'text'=>$data['text'],'mode'=>'standard','stream'=>false,
                ]);
            return response()->json($result->json(),$result->status())
                ->header('Cache-Control','no-store');
        } catch (\Illuminate\Http\Client\ConnectionException $error) {
            return response()->json(['error'=>['message'=>'The writing service could not be reached.']],502);
        }
    }
}

For a fresh example, routes/web.php can contain:

<?php
use Illuminate\Support\Facades\Route;
use App\Http\Controllers\MetaPhraseController;
Route::view('/','writer');
Route::post('/api/metaphrase',[MetaPhraseController::class,'paraphrase'])->middleware('throttle:15,1');

Save as resources/views/writer.blade.php:

<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="csrf-token" content="{{ csrf_token() }}"><title>My paraphraser</title></head><body>
<main style="max-width:760px;margin:50px auto;padding:20px;font:16px system-ui"><h1>My paraphraser</h1><form id="writer"><label>Your text<textarea name="text" required style="display:block;width:100%;height:180px"></textarea></label><button>Paraphrase</button></form><p id="error" role="alert"></p><pre id="result" style="white-space:pre-wrap"></pre></main>
<script>const form=document.getElementById('writer');form.addEventListener('submit',async event=>{event.preventDefault();const button=form.querySelector('button');button.disabled=true;document.getElementById('error').textContent='';try{const response=await fetch('/api/metaphrase',{method:'POST',headers:{'Content-Type':'application/json','Accept':'application/json','X-CSRF-TOKEN':document.querySelector('meta[name="csrf-token"]').content},body:JSON.stringify({text:form.elements.text.value})});const value=await response.json();if(!response.ok)throw new Error(value.error?.message??value.message??'Please retry.');document.getElementById('result').textContent=value.result.text;}catch(error){document.getElementById('error').textContent=error.message;}finally{button.disabled=false;}});</script></body></html>

Run php artisan config:clear after changing local configuration, then php artisan serve. Laravel's web CSRF middleware and throttle remain enabled. For production configure your application's authentication, trusted proxies and shared throttle store as usual. The browser receives no API key. The Blade {{ csrf_token() }} expression is Laravel syntax and must remain unchanged.