3 ms·

Unless it's the client's keys. Or keys obtained on the client's behalf.

ozfive 2y ago
Even using the client's keys it would be a good idea to give a disclaimer that their key may be stored (If that is the case) and can be accessible through nefarious means. People are very susceptible to phishing attempts etc. and this sort of business model (where you have the client supply the key and store it through the browser is a slippery slope.
- skybrian 2y ago
  Yes, it’s like storing passwords.
  - TeMPOraL 2y ago
    Yes. It's as bad as using password managers. Wait.
    - skybrian 2y ago
      From an application developer's perspective, the nice thing about using a passkey with a browser cookie is that you don't have to store anything sensitive. You're only guarding access to your own app with meaningless numbers. If your app doesn't store other sensitive data, the blast radius is small. There are still denial of service attacks to worry about where an attacker can use network or compute to run up your bill. What are we guarding when building an app that uses a cloud API that costs money? Access to more compute resources. Probably a lot more than the app itself ever uses. It raises the stakes a bit. Still, in monetary terms, you're operating a vending machine that the user puts money into. Maybe there could be some kind of protocol and workflow to securely buy a dollar of compute time from an AI vendor? If they send some of the money to the app developer's account, it's starting to sound like an app store or micropayments system.
- panarky 2y ago
  Let's not train users to do things that are generally unsafe. "We detected fraud on your account. Click here to secure your account." "Copy and paste your secret into this box, you can trust us not to look at it."
creesch 2y ago
Generally speaking that is what OAuth should be used for with clearly defined scopes and insights in what apps are making use of the API through your account. Not an API key with full access and no limitations. With openAI and other providers, I know you can limit the budget for a key, but that is still a pretty broad scope you are left with.
- jillesvangurp 2y ago
  Do OpenAI and Claude support OAuth? I don't think they do (except for simple bearer tokens on API calls).
  - simonw 2y ago
    They don’t - which is a shame, I’d love to be able to bounce a user through an OAuth flow and then make API calls using their token such that their activity is billed to them directly.
  - creesch 2y ago
    They don't, but they probably should imho. I was just talking about best practices in general.
- TeMPOraL 2y ago
  OAuth is nice when you're making an interactive in-browser SaaS. Sucks for just about any other application, in particular anything that may run headless. Thankfully, OpenAI and the like offer actual APIs I can use for software and automation I write. And it is my right, both as a user and a developer, to let someone else write the software I'll use with my keys. It's up to me to decide if I trust that software, and suffer the consequences of a mistake. It's like the most basic way of using software, and I appreciate when I can use it like that, without having anyone insert themselves in the middle to help me stay "more secure".
  - creesch 2y ago
    Mate, the context is that Claude now supports CORS. We are talking about in-browser use.

Even using the client's keys it would be a good idea to give a disclaimer that their key may be stored (If that is the case) and can be accessible through nefarious means. People are very susceptible to phishing attempts etc. and this sort of business model (where you have the client supply the key and store it through the browser is a slippery slope.

skybrian 2y ago
Yes, it’s like storing passwords.
- TeMPOraL 2y ago
  Yes. It's as bad as using password managers. Wait.
  - skybrian 2y ago
    From an application developer's perspective, the nice thing about using a passkey with a browser cookie is that you don't have to store anything sensitive. You're only guarding access to your own app with meaningless numbers. If your app doesn't store other sensitive data, the blast radius is small. There are still denial of service attacks to worry about where an attacker can use network or compute to run up your bill. What are we guarding when building an app that uses a cloud API that costs money? Access to more compute resources. Probably a lot more than the app itself ever uses. It raises the stakes a bit. Still, in monetary terms, you're operating a vending machine that the user puts money into. Maybe there could be some kind of protocol and workflow to securely buy a dollar of compute time from an AI vendor? If they send some of the money to the app developer's account, it's starting to sound like an app store or micropayments system.
panarky 2y ago
Let's not train users to do things that are generally unsafe. "We detected fraud on your account. Click here to secure your account." "Copy and paste your secret into this box, you can trust us not to look at it."

creesch 2y ago

Generally speaking that is what OAuth should be used for with clearly defined scopes and insights in what apps are making use of the API through your account. Not an API key with full access and no limitations. With openAI and other providers, I know you can limit the budget for a key, but that is still a pretty broad scope you are left with.

jillesvangurp 2y ago
Do OpenAI and Claude support OAuth? I don't think they do (except for simple bearer tokens on API calls).
- simonw 2y ago
  They don’t - which is a shame, I’d love to be able to bounce a user through an OAuth flow and then make API calls using their token such that their activity is billed to them directly.
- creesch 2y ago
  They don't, but they probably should imho. I was just talking about best practices in general.
TeMPOraL 2y ago
OAuth is nice when you're making an interactive in-browser SaaS. Sucks for just about any other application, in particular anything that may run headless. Thankfully, OpenAI and the like offer actual APIs I can use for software and automation I write. And it is my right, both as a user and a developer, to let someone else write the software I'll use with my keys. It's up to me to decide if I trust that software, and suffer the consequences of a mistake. It's like the most basic way of using software, and I appreciate when I can use it like that, without having anyone insert themselves in the middle to help me stay "more secure".
- creesch 2y ago
  Mate, the context is that Claude now supports CORS. We are talking about in-browser use.