How are people using the Claude API as individuals? Officially, individuals are not allowed to use the API. https://support.anthropic.com/en/articles/8987200-can-i-use-...
Everyone’s their own Sole Proprietorship?
Claude's API now supports CORS requests, enabling client-side applications
121–130 of 173 posts
Re: Claude's API now supports CORS requests, enabling client-side applications
#122I mean, you could have just made a quick proxy with a little express server to get around this anyways. But I shouldn't be complaining, it's good that they did this.
Edit: of course, I just realized that people may not want their api key being sent to your server.
Re: Claude's API now supports CORS requests, enabling client-side applications
#123How are people using the Claude API as individuals? Officially, individuals are not allowed to use the API. https://support.anthropic.com/en/articles/8987200-can-i-use-...
[deleted]
Re: Claude's API now supports CORS requests, enabling client-side applications
#124Earlier quoted context omitted.
I don’t understand why you’re being downvoted. I think this is a reasonable approach. If you want convenience, you pay for it – otherwise it‘s BYOK.
I think it was probably the gratuitous inclusion of the url
It wasn’t gratuitous at all and the “self-promotion police” are an insufferable plague on this website.
Re: Claude's API now supports CORS requests, enabling client-side applications
#125Web security noob here. Why does CORS even exist? The fact that a website can’t make a request to another website unless that domain likes it is kind of insane to me. Everyone in the comments here is going on about how maybe the user’s API key gets leaked by a malicious application or whatever but, like, when I write software that isn’t in the browser I can just send a request to anyone without restrictions and as fa…
CORS is designed to protect the server data. It's a tool that gives servers a control mechanism to tell browsers "who can access my data". Imagine that your banking website used a standard JSON+REST API with cookie based authentication to trigger & validate a transaction request. When a request to `fetch` or XMLHTTPRequest is made from ANY site, the browser will still populate cookies for 3rd party sites. So without…
This is mostly correct, but one thing that's worth pointing out is that CORS doesn't protect anything, but it 'loosens' the protection that the browser has by default. The S in CORS stands for sharing, not security.
Re: Claude's API now supports CORS requests, enabling client-side applications
#126Earlier quoted context omitted.
OAuth is nice when you're making an interactive in-browser SaaS. Sucks for just about any other application, in particular anything that may run headless. Thankfully, OpenAI and the like offer actual APIs I can use for software and automation I write. And it is my right, both as a user and a developer, to let someone else write the software I'll use with my keys. It's up to me to decide if I trust that software, and…
Mate, the context is that Claude now supports CORS. We are talking about in-browser use.
Sure, but people are suggesting OpenAI and Anthropic should use OAuth instead of API keys. It hardly makes sense to provide both for the same functionality.
Also CORS is a PITA. Even for personal use, a browser is the most convenient environment to develop some helper tools and scripts, and it's also the only environment that - until now - could not be used with those APIs. The solution here definitely isn't moving from API keys to OAuth.
Re: Claude's API now supports CORS requests, enabling client-side applications
#127Earlier quoted context omitted.
>> why this took them so long They were trying to have Claude code it up - but every time it got close to working, Claude would lose context and hallucinate and the code would break. Been there too many times with Good Ol' Claude.
funny but this proves that claude is now good for code?
Claude 3.5 Sonnet is best model at coding.
Re: Claude's API now supports CORS requests, enabling client-side applications
#128Claude is growing strong with these new features
Re: Claude's API now supports CORS requests, enabling client-side applications
#129Web security noob here. Why does CORS even exist? The fact that a website can’t make a request to another website unless that domain likes it is kind of insane to me. Everyone in the comments here is going on about how maybe the user’s API key gets leaked by a malicious application or whatever but, like, when I write software that isn’t in the browser I can just send a request to anyone without restrictions and as fa…
A soldier gets back from the front and gets a job in IT moderating internet comments. A few months later he calls his CO and asks to be sent back to the front. The CO asks "why would you want to do that?" He replies, "there's a lot less fear over there."
You get downvoted, but that's pretty much spot on. I've wasted many days of my life trying to navigate around security in the browser and HTTPS everything, mostly unsuccessfully, and I only see increasingly insane lock-downs appearing as time goes on.
It feels like that the only mode of use of a computer that's allowed by security-minded folks is being a company selling shit on-line, or a customer of one. Try anything like making a simple browser UI to use some internal API, even on localhost, and you quickly end up running your own certificate authority, CORS proxy and having to buy a domain.
I mean, the very concept that the only right way to do HTTPS for internal tools is to have a public certificate on a public Internet domain, thus having to pay third parties and leaking information via certificate transparency logs, is insane when you're just doing your own stuff on your own LAN, and need to use a browser (entirely locally) or touch anything on the Internet.
Re: Claude's API now supports CORS requests, enabling client-side applications
#130Earlier quoted context omitted.
Mate, the context is that Claude now supports CORS. We are talking about in-browser use.
Sure, but people are suggesting OpenAI and Anthropic should use OAuth instead of API keys. It hardly makes sense to provide both for the same functionality. Also CORS is a PITA. Even for personal use, a browser is the most convenient environment to develop some helper tools and scripts, and it's also the only environment that - until now - could not be used with those APIs. The solution here definitely isn't moving f…
> Sure, but people are suggesting OpenAI and Anthropic should use OAuth instead of API keys.
No, they should offer it. As for the majority of webbrowser based use cases, it is a more appropriate solution.