Claude's API now supports CORS requests, enabling client-side applications

Re:Claude's API now supports CORS requests, enabling client-... by apitman on Friday August 23, 2024 @12:47PM (#41330569)

The UX could be so much better and more secure. This type of use case is a perfect fit for OAuth2.

Current UX:

1. User hits your app

2. You tell them to go to Anthropic and generate an API key. You'll probably need to give them instructions on how to do so, which will become outdated over time as Anthropic makes changes to their website.

3. User goes to Anthropic and generates an API key

4. User manually navigates back to your app and pastes the key

OAuth2 UX:

1. You redirect the user to Anthropic

2. The user approves your app getting access

3. Anthropic redirects the user back to you and your app starts working.

For the life of me I don't understand why orgs don't implement OAuth2 for basically everything. Yes it is more complicated on the developer side, but that's for good security reasons. And it isn't that bad, and well worth the moderate time investment.

[ Parent | on HN ]

Re:Claude's API now supports CORS requests, enabling client-... by tsimionescu on Friday August 23, 2024 @04:07PM (#41332637)

You have to remember that dev time is always at a premium. Even if it takes one week to build OAuth2 support, that's one week delay on other features. It's always a matter of priorities.

[ Parent | on HN ]

Re:Claude's API now supports CORS requests, enabling client-... by jameshart on Friday August 23, 2024 @05:13PM (#41333157)

Sure but the alternative we are talking about here is encouraging developers to paste their API keys into random web pages.

I don’t think we should accept the argument that since implementing a respectable authorization scheme might take a bit of effort, it’s okay for sites to ask users to just hand over their password.

[ Parent | on HN ]

Re:Claude's API now supports CORS requests, enabling client-... by shankspeaks on Saturday August 24, 2024 @02:15AM (#41336058)

Wait... can't they use Claude to build this for them? :)

[ Parent | on HN ]

Re:Claude's API now supports CORS requests, enabling client-... by spyspy on Friday August 23, 2024 @01:14PM (#41330856)

Devs here often don’t even really understand JWT tokens as evidenced by the hundreds-of-comments deep arguments I’ve witnessed over them.

[ Parent | on HN ]

Re:Claude's API now supports CORS requests, enabling client-... by apitman on Friday August 23, 2024 @01:22PM (#41330932)

JWTs are orthogonal to OAuth2. Tokens in OAuth2 are opaque to the client applications. JWTs are one way to do it, though with significant tradeoffs.

[ Parent | on HN ]