Great to see CORS support added! This will make integrating Claude's API into client-side apps much smoother.
Claude's API now supports CORS requests, enabling client-side applications
71–80 of 173 posts
Re: Claude's API now supports CORS requests, enabling client-side applications
#72Earlier quoted context omitted.
Yes, we're now at an inflection point where this is starting to become possible. gpt-4o mini costs $0.15 per 1 million input tokens, and $0.60 per 1 million output. This is cheap enough that it can, at least in some cases, be funded by ad impressions. Of course, the implications here are mixed. If you want to build an ad-supported tool that actually helps people, that's great. But it also means it now makes clear fin…
This is also pricing for customers, not what it actually costs to run.
Yes, but that's what's relevant, right? If I create a service, I don't really care if OpenAI makes a killing or is subsidizing my cost with venture capital, what matters to me is how much I pay to OpenAI, and how much revenue my service generates.
Re: Claude's API now supports CORS requests, enabling client-side applications
#73Web security noob here. Why does CORS even exist? The fact that a website can’t make a request to another website unless that domain likes it is kind of insane to me. Everyone in the comments here is going on about how maybe the user’s API key gets leaked by a malicious application or whatever but, like, when I write software that isn’t in the browser I can just send a request to anyone without restrictions and as fa…
CORS - or specifically, not permitting cross-origin requests by default - is for preventing CSRF, cross-site request forgery. In particular if the user's credentials (cookies) are passed along with a request to a third party site, then the first party site can act as the user with the user's authority. In other words, evil.com could e.g. send emails on your behalf by making direct requests to your email provider's we…
Ok but like why would you pass cookies along
Re: Claude's API now supports CORS requests, enabling client-side applications
#74Earlier quoted context omitted.
This is also pricing for customers, not what it actually costs to run.
Yes, but that's what's relevant, right? If I create a service, I don't really care if OpenAI makes a killing or is subsidizing my cost with venture capital, what matters to me is how much I pay to OpenAI, and how much revenue my service generates.
It's relevant as far as the providers of said LLM inference could always swoop in, undercut you and take your business if they feel like it. But they could do that anyways, no matter if they do it at a profit or not.
Re: Claude's API now supports CORS requests, enabling client-side applications
#75I'm really glad to see this. Last week, when I upgraded the Anthropic TypeScript SDK from 0.23.0 to 0.26.0, my browser extension (chathub.gg) broke because they completely banned the use of this SDK in browsers!
Re: Claude's API now supports CORS requests, enabling client-side applications
#76Earlier quoted context omitted.
Yes, but that's what's relevant, right? If I create a service, I don't really care if OpenAI makes a killing or is subsidizing my cost with venture capital, what matters to me is how much I pay to OpenAI, and how much revenue my service generates.
It's relevant as far as the providers of said LLM inference could always swoop in, undercut you and take your business if they feel like it. But they could do that anyways, no matter if they do it at a profit or not.
This assumes the service developer adds no value to this process. Because otherwise its like saying nVidia can swoop in on EA's business.
Edit: s/App/service.
Re: Claude's API now supports CORS requests, enabling client-side applications
#77Earlier quoted context omitted.
Could ads even support such AI heavy use cases? I'm kind of out of touch with current AI API pricing and ad revenues, so i'm curious how the economics work out.
Yes, we're now at an inflection point where this is starting to become possible. gpt-4o mini costs $0.15 per 1 million input tokens, and $0.60 per 1 million output. This is cheap enough that it can, at least in some cases, be funded by ad impressions. Of course, the implications here are mixed. If you want to build an ad-supported tool that actually helps people, that's great. But it also means it now makes clear fin…
Another implication is that you're dependent on it remaining cheap enough. You risk VC money running out and them having to jack up prices, or them doing so because they managed to capture the whole market.
Re: Claude's API now supports CORS requests, enabling client-side applications
#78Earlier quoted context omitted.
I offer both in https://kidzfun.art . If you're non-technical, you can buy packs of 100 images and it uses my key to access Dall-E, or you can provide your own key and pay nothing to me. The vast majority of users go the simpler way, but it's a nice bonus for technical users to just reuse their own key. The difference with your approach is that I store an encrypted copy server side as I do all the AI generation on th…
I don’t understand why you’re being downvoted. I think this is a reasonable approach. If you want convenience, you pay for it – otherwise it‘s BYOK.
Not saying it isn't reasonable, but I'm guessing people might downvote because of storing secrets server-side rather than passing them on from the frontend and saving them there instead. People get worried as soon as secrets are stored anywhere :)
Re: Claude's API now supports CORS requests, enabling client-side applications
#79Earlier quoted context omitted.
CORS is designed to protect the server data. It's a tool that gives servers a control mechanism to tell browsers "who can access my data". Imagine that your banking website used a standard JSON+REST API with cookie based authentication to trigger & validate a transaction request. When a request to `fetch` or XMLHTTPRequest is made from ANY site, the browser will still populate cookies for 3rd party sites. So without…
> When a request to `fetch` or XMLHTTPRequest is made from ANY site, the browser will still populate cookies for 3rd party sites. I think this is the problem here? Just send the request without cookies if CORS doesn't allow it. (I also think third-party cookies were a mistake in general, and it would be a good thing if they were removed. There were some plans but well, Google.)
> I think this is the problem here? Just send the request without cookies if CORS doesn't allow it.
Yup, very obviously a problem and it's why we got CORS :) But just because it's a problem, doesn't mean we can remove it from all browsers and call it a day, it'll break huge parts of the internet.
So in true internet engineering fashion we do what we always do, pile yet another layer on top of the stack to fix some issues from the previous layer (and add some more complications for the next (future) layer).
Re: Claude's API now supports CORS requests, enabling client-side applications
#80I love making web apps where users bring their own keys. This approach combines the best of both worlds: the convenience of distributing executable files and the benefits of open source. So far, I have developed two web apps: 1. A live transcription and translation app that uses microphone input. This is useful for watching proprietary content and facilitating communication. 2. An app that translates SRT subtitles in…
I put together https://nfriedly.github.io/contributor-locations/ a while back, which has the same idea except that the access token is optional. GitHub's API provides a small number of request without one, but adding an API key will enable it to do more.