Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude's API now supports CORS requests, enabling client-side applications

simonwillison.net

Post reply on HN
Print view View original

141–150 of 173 posts

Re: Claude's API now supports CORS requests, enabling client-side applications

#141

Post by bilater »

afiodorov wrote: post #10

I love making web apps where users bring their own keys. This approach combines the best of both worlds: the convenience of distributing executable files and the benefits of open source. So far, I have developed two web apps: 1. A live transcription and translation app that uses microphone input. This is useful for watching proprietary content and facilitating communication. 2. An app that translates SRT subtitles in…

I love this pattern as well, but as some comments have pointed out, there is a pitfall of security risk (you don't know where your API key is going). I think it would be really cool if more services let you cap API key usage, so it's almost like a virtual credit card number. I could then put in API keys to sites without worrying and knowing that at most, I can lose, say, $10 or something.

Re: Claude's API now supports CORS requests, enabling client-side applications

#142

Post by riquito »

_pdp_ wrote: post #68

I don't see this being a problem in situations where a customer / user can bring their own keys. The actions happens on the client-side and as long as the device or the website are not compromised it is all good. However, this is definitely increasing the attack surface where a developer may decide for whatever reason to use production keys client-side without proxying the requests as they would normally do. I can se…

> as long as the device or the website are not compromised it is all good

But that is THE problem. You are making yourself a huge target. The more users you have the most likely someone will attempt to hack you to use all those keys. The "client side" point is moot because the code that uses those keys comes from the server, once that's compromised all hell is loose.

Re: Claude's API now supports CORS requests, enabling client-side applications

#143

Post by ikekkdcjkfke »

_pdp_ wrote: post #68

I don't see this being a problem in situations where a customer / user can bring their own keys. The actions happens on the client-side and as long as the device or the website are not compromised it is all good. However, this is definitely increasing the attack surface where a developer may decide for whatever reason to use production keys client-side without proxying the requests as they would normally do. I can se…

Notnpossible to generate a limitee key in 2024?

Re: Claude's API now supports CORS requests, enabling client-side applications

#144

Post by skybrian »

TeMPOraL wrote: post #38
skybrian wrote: post #12

Earlier quoted context omitted.

Yes, it’s like storing passwords.

Yes. It's as bad as using password managers. Wait.

From an application developer's perspective, the nice thing about using a passkey with a browser cookie is that you don't have to store anything sensitive. You're only guarding access to your own app with meaningless numbers. If your app doesn't store other sensitive data, the blast radius is small. There are still denial of service attacks to worry about where an attacker can use network or compute to run up your bill.

What are we guarding when building an app that uses a cloud API that costs money? Access to more compute resources. Probably a lot more than the app itself ever uses. It raises the stakes a bit. Still, in monetary terms, you're operating a vending machine that the user puts money into.

Maybe there could be some kind of protocol and workflow to securely buy a dollar of compute time from an AI vendor?

If they send some of the money to the app developer's account, it's starting to sound like an app store or micropayments system.

Re: Claude's API now supports CORS requests, enabling client-side applications

#145

Post by simonw »

bilater wrote: post #141
afiodorov wrote: post #10

I love making web apps where users bring their own keys. This approach combines the best of both worlds: the convenience of distributing executable files and the benefits of open source. So far, I have developed two web apps: 1. A live transcription and translation app that uses microphone input. This is useful for watching proprietary content and facilitating communication. 2. An app that translates SRT subtitles in…

I love this pattern as well, but as some comments have pointed out, there is a pitfall of security risk (you don't know where your API key is going). I think it would be really cool if more services let you cap API key usage, so it's almost like a virtual credit card number. I could then put in API keys to sites without worrying and knowing that at most, I can lose, say, $10 or something.

This is absolutely the thing I most want: it should be trivially easy to create a dedicated API key with e.g. a $5 maximum spend that I can share with a "bring your own key" tool.

Being able to issue those via an OAuth flow as opposed to copy-and-paste would be nice, but the fundamental thing I want is per-app spending limits.

Re: Claude's API now supports CORS requests, enabling client-side applications

#146

Post by MitchellCash »

MeetingsBrowser wrote: post #115

How are people using the Claude API as individuals? Officially, individuals are not allowed to use the API. https://support.anthropic.com/en/articles/8987200-can-i-use-...

I’m going to out myself, but you just do it anyway…

Re: Claude's API now supports CORS requests, enabling client-side applications

#147

Post by tabgram »

simonw wrote: post #145
bilater wrote: post #141

Earlier quoted context omitted.

I love this pattern as well, but as some comments have pointed out, there is a pitfall of security risk (you don't know where your API key is going). I think it would be really cool if more services let you cap API key usage, so it's almost like a virtual credit card number. I could then put in API keys to sites without worrying and knowing that at most, I can lose, say, $10 or something.

This is absolutely the thing I most want: it should be trivially easy to create a dedicated API key with e.g. a $5 maximum spend that I can share with a "bring your own key" tool. Being able to issue those via an OAuth flow as opposed to copy-and-paste would be nice, but the fundamental thing I want is per-app spending limits.

Obviously you aware, but let me still say it: openrouter is for me a trivially easy way to create dedicated keys with max limit https://openrouter.ai/credits or am I missing something?

Re: Claude's API now supports CORS requests, enabling client-side applications

#148

Post by bilater »

tabgram wrote: post #147
simonw wrote: post #145

Earlier quoted context omitted.

This is absolutely the thing I most want: it should be trivially easy to create a dedicated API key with e.g. a $5 maximum spend that I can share with a "bring your own key" tool. Being able to issue those via an OAuth flow as opposed to copy-and-paste would be nice, but the fundamental thing I want is per-app spending limits.

Obviously you aware, but let me still say it: openrouter is for me a trivially easy way to create dedicated keys with max limit https://openrouter.ai/credits or am I missing something?

oh this is interesting thanks for linking gonna check em out

Re: Claude's API now supports CORS requests, enabling client-side applications

#149

Post by tsimionescu »

apitman wrote: post #131
afiodorov wrote: post #10

I love making web apps where users bring their own keys. This approach combines the best of both worlds: the convenience of distributing executable files and the benefits of open source. So far, I have developed two web apps: 1. A live transcription and translation app that uses microphone input. This is useful for watching proprietary content and facilitating communication. 2. An app that translates SRT subtitles in…

The UX could be so much better and more secure. This type of use case is a perfect fit for OAuth2. Current UX: 1. User hits your app 2. You tell them to go to Anthropic and generate an API key. You'll probably need to give them instructions on how to do so, which will become outdated over time as Anthropic makes changes to their website. 3. User goes to Anthropic and generates an API key 4. User manually navigates ba…

You have to remember that dev time is always at a premium. Even if it takes one week to build OAuth2 support, that's one week delay on other features. It's always a matter of priorities.

Re: Claude's API now supports CORS requests, enabling client-side applications

#150

Post by ianbicking »

afiodorov wrote: post #10

I love making web apps where users bring their own keys. This approach combines the best of both worlds: the convenience of distributing executable files and the benefits of open source. So far, I have developed two web apps: 1. A live transcription and translation app that uses microphone input. This is useful for watching proprietary content and facilitating communication. 2. An app that translates SRT subtitles in…

OpenRouter.ai does this pretty well. It has a pretty reasonable flow. It supports enough free models that you can do at least _something_ without a person having to pay anything (even if quality is a bit iffy). They have user-set spending limits, and each key is bound to the service. Their privacy policies seem decent.

The other option is Gemini, which has enough free credits to really be free for any small app. Unfortunately you can't use that through OpenRouter, you need your own developer account to be able to take advantage of Gemini's free offering.

Post reply on HN