3 ms·

Mate, the context is that Claude now supports CORS. We are talking about in-browser use.

• TeMPOraL 2y ago
  Sure, but people are suggesting OpenAI and Anthropic should use OAuth instead of API keys. It hardly makes sense to provide both for the same functionality. Also CORS is a PITA. Even for personal use, a browser is the most convenient environment to develop some helper tools and scripts, and it's also the only environment that - until now - could not be used with those APIs. The solution here definitely isn't moving from API keys to OAuth.
  • creesch 2y ago
    > Sure, but people are suggesting OpenAI and Anthropic should use OAuth instead of API keys. No, they should offer it. As for the majority of webbrowser based use cases, it is a more appropriate solution.
  • apitman 2y ago
    I don't think there's any reason to draw such a hard distinction between API keys and OAuth2 tokens. Either can be a subset of the other. In a well-designed OAuth2 flow, the user should be able to select fine-grained permissions if they want to. You should be offering that same level of control for API keys. I don't see why they can't share almost all the same infrastructure. The main different is the API calls needed for OAuth2, but it's a huge value add. You can still let people generate keys if they want to, but a well-implemented OAuth2 deployment is superior even in headless cases. Rather than having to click through the dashboard generating and copypasting keys, I can enter a short OAuth2 code in the CLI and be off to the races. Plus you get all the security benefits of token rotation, etc.