3 ms·
The UX could be so much better and more secure. This type of use case is a perfect fit for OAuth2. Current UX: 1. User hits your app 2. You tell them to go t
by apitman 2y ago
The UX could be so much better and more secure. This type of use case is a perfect fit for OAuth2.
Current UX:
1. User hits your app
2. You tell them to go to Anthropic and generate an API key. You'll probably need to give them instructions on how to do so, which will become outdated over time as Anthropic makes changes to their website.
3. User goes to Anthropic and generates an API key
4. User manually navigates back to your app and pastes the key
OAuth2 UX:
1. You redirect the user to Anthropic
2. The user approves your app getting access
3. Anthropic redirects the user back to you and your app starts working.
For the life of me I don't understand why orgs don't implement OAuth2 for basically everything. Yes it is more complicated on the developer side, but that's for good security reasons. And it isn't that bad, and well worth the moderate time investment.
- spyspy 2y agoDevs here often don’t even really understand JWT tokens as evidenced by the hundreds-of-comments deep arguments I’ve witnessed over them.
- apitman 2y agoJWTs are orthogonal to OAuth2. Tokens in OAuth2 are opaque to the client applications. JWTs are one way to do it, though with significant tradeoffs.
- tsimionescu 2y agoYou have to remember that dev time is always at a premium. Even if it takes one week to build OAuth2 support, that's one week delay on other features. It's always a matter of priorities.
- jameshart 2y agoSure but the alternative we are talking about here is encouraging developers to paste their API keys into random web pages. I don’t think we should accept the argument that since implementing a respectable authorization scheme might take a bit of effort, it’s okay for sites to ask users to just hand over their password.
- shankspeaks 2y agoWait... can't they use Claude to build this for them? :)