Live data from Hacker News

Claude's API now supports CORS requests, enabling client-side applications

simonwillison.net

41–50 of 173 posts

Re: Claude's API now supports CORS requests, enabling client-side applications

#41
post #3

Earlier quoted context omitted.

I'm thinking it enables apps where users can bring their own keys without exposing it to my server.

That's the only good use of this but I bet people will end up leaking their keys being stupid with it.

That's on them though. It's nice to have an option where the third party app just provides its value-add, instead of insisting on being the first party.

Re: Claude's API now supports CORS requests, enabling client-side applications

#42
post #32

Earlier quoted context omitted.

I do the same now for a firefox extension I wrote (automatic form-filler that works way way better than anything else out there). So it's also "bring your own keys" but then how do you monetize at all? I personally don't like "bring your own keys" at all from a user-friendlyness perspective. It means that you exclude the vast majority of potential users, because they don't know what that even means. Even "create an a…

"Bring your own keys" can mean a "log in with OpenAI" button. Having users navigate through a third party's arcane dev portal isn't a good experience, but that third party can make it painless for users if they so choose.

I absolutely think that OpenAI or Anthropic should provide such integration. It’s very similar to how Apple Pay centralises your subscriptions and makes payments secure and simple. Would be nice if AI labs had an equivalent portal where each authorized app gets its own key and I can cancel any time and control my spending. Finally that might enable some kind of monetisation if OpenAI or Anthropic give developers a cut, e.g. 10% mark-up that goes to the authorized app.

Re: Claude's API now supports CORS requests, enabling client-side applications

#43

[flagged]

it doesn't. you're misunderstanding the pieces in play here

there's:

you

claude

other company

this CORS change lets other company use your key to access claude, so you pay to use Claude instead of having to create an account with other company so they can pay Claude.

that change doesn't let coffee shop or other MitM see your Claude key

Re: Claude's API now supports CORS requests, enabling client-side applications

#44
post #29

Earlier quoted context omitted.

[flagged]

Don’t try to support your arguments by pasting paragraphs of text from ChatGPT. That said, there is a little nugget of useful information in there: “To do this, they install a corporate root certificate on all employee devices.” This is true: if you are using a device which has had a root certificate installed on it you are vulnerable to MITM attacks. I would argue that your employer stealing your Anthropic API key i…

[flagged]

Re: Claude's API now supports CORS requests, enabling client-side applications

#45

I love making web apps where users bring their own keys. This approach combines the best of both worlds: the convenience of distributing executable files and the benefits of open source. So far, I have developed two web apps: 1. A live transcription and translation app that uses microphone input. This is useful for watching proprietary content and facilitating communication. 2. An app that translates SRT subtitles in…

I do the same now for a firefox extension I wrote (automatic form-filler that works way way better than anything else out there). So it's also "bring your own keys" but then how do you monetize at all? I personally don't like "bring your own keys" at all from a user-friendlyness perspective. It means that you exclude the vast majority of potential users, because they don't know what that even means. Even "create an a…

> So it's also "bring your own keys" but then how do you monetize at all?

Why do you need to monetize? The original comment you replied to talked about making something for the world and sharing it. They said they didn’t want to maintain it, they didn’t want to be obligated to care for it. You can’t make that choice if people are paying you (or at least shouldn’t…).

I don’t understand the BYOx use case for a monetized product. If you’re BYO api, you’re essentially missing the opportunity to monetize a spread on API requests. The more a customer uses your product (because it’s good), the more you’d make. That’s the best case scenario because it means everyone is finding value.

Re: Claude's API now supports CORS requests, enabling client-side applications

#46
post #32

Earlier quoted context omitted.

"Bring your own keys" can mean a "log in with OpenAI" button. Having users navigate through a third party's arcane dev portal isn't a good experience, but that third party can make it painless for users if they so choose.

I absolutely think that OpenAI or Anthropic should provide such integration. It’s very similar to how Apple Pay centralises your subscriptions and makes payments secure and simple. Would be nice if AI labs had an equivalent portal where each authorized app gets its own key and I can cancel any time and control my spending. Finally that might enable some kind of monetisation if OpenAI or Anthropic give developers a cu…

> Finally that might enable some kind of monetisation if OpenAI or Anthropic give developers a cut, e.g. 10% mark-up that goes to the authorized app.

I was totally against you until this, but it’s an interesting idea. Its still early, but seems like OpenAI hasn’t succeeded any more to be broad consumer product past the core Chat experience. Building an AI OAuth platform would be an interesting way to be sticky and avoid being a commodity. But it’d give developers more leverage vs their custom-GPT product, and it’d shift charging per-use for an API to “unlimited” per month for a single subscription fee.

Generally, a product shouldn’t tie themselves to an API provider (eg OpenAI) when it could’ve been an implementation detail. If you hide the actual API from users, you can swap it for cheaper or better ones as the market evolves. If you give up the account access to a providers OAuth, and you give up control over that implementation, you risk being really stuck to a market loser and no direct relationship with users.

Getting paid for it though…. That would be an interesting twist. But I’m not sure it’d make sense as anything but a bulk discount. The problem is that it doesn’t make sense to pay a developer to use your paid product, unless you get a relationship with the end users like Google Search defaults in browsers. But again, it doesn’t make sense to give OpenAI that relationship if you don’t have to.

Re: Claude's API now supports CORS requests, enabling client-side applications

#47
post #29

Earlier quoted context omitted.

Don’t try to support your arguments by pasting paragraphs of text from ChatGPT. That said, there is a little nugget of useful information in there: “To do this, they install a corporate root certificate on all employee devices.” This is true: if you are using a device which has had a root certificate installed on it you are vulnerable to MITM attacks. I would argue that your employer stealing your Anthropic API key i…

[flagged]

"Don’t try to support your arguments by pasting paragraphs of text from ChatGPT."

Agreed. Please don't do this.

Re: Claude's API now supports CORS requests, enabling client-side applications

#48

I love making web apps where users bring their own keys. This approach combines the best of both worlds: the convenience of distributing executable files and the benefits of open source. So far, I have developed two web apps: 1. A live transcription and translation app that uses microphone input. This is useful for watching proprietary content and facilitating communication. 2. An app that translates SRT subtitles in…

I do the same, I make chrome extensions and my most recent extension uses a byo api key model for calls to an LLM.

Means I can offer the service for free and not worry about hosting keys, serving ads, and storing users keys in a db. Everything can be done client side.

Good to hear I’m not alone in the endeavour, what software are you building?

Re: Claude's API now supports CORS requests, enabling client-side applications

#49

I love making web apps where users bring their own keys. This approach combines the best of both worlds: the convenience of distributing executable files and the benefits of open source. So far, I have developed two web apps: 1. A live transcription and translation app that uses microphone input. This is useful for watching proprietary content and facilitating communication. 2. An app that translates SRT subtitles in…

I do the same now for a firefox extension I wrote (automatic form-filler that works way way better than anything else out there). So it's also "bring your own keys" but then how do you monetize at all? I personally don't like "bring your own keys" at all from a user-friendlyness perspective. It means that you exclude the vast majority of potential users, because they don't know what that even means. Even "create an a…

Bring your own keys to minimise costs, you can still charge a subscription or one off charge for the base service if it’s a SaaS extension or similar

Re: Claude's API now supports CORS requests, enabling client-side applications

#50

I love making web apps where users bring their own keys. This approach combines the best of both worlds: the convenience of distributing executable files and the benefits of open source. So far, I have developed two web apps: 1. A live transcription and translation app that uses microphone input. This is useful for watching proprietary content and facilitating communication. 2. An app that translates SRT subtitles in…

I do the same, I make chrome extensions and my most recent extension uses a byo api key model for calls to an LLM. Means I can offer the service for free and not worry about hosting keys, serving ads, and storing users keys in a db. Everything can be done client side. Good to hear I’m not alone in the endeavour, what software are you building?

I made two one-page react apps

https://www.livetranslate.net/

https://www.subsgpt.com/

Second one is more refined but both are functional.

I was pleasantly surprised somebody made a YouTube tutorial in Japanese about the latter https://www.youtube.com/watch?v=8gAkvZYayEc - feels like retro internet where people share things on their personal webpages.

Curiously the first one also landed me a contracting opportunity for a company that wanted to add live captions to their product and we went live with my help.

I also made a decentralized twitter dapp ages ago but AI apps definitely have had more interest.

Post reply on HN