News for hackers. Stuff that matters.

A comment on Claude's API now supports CORS requests, enabling client-side applications. Parent comment

Re:Claude's API now supports CORS requests, enabling client-... by bilater on Friday August 23, 2024 @01:47PM (#41331212)
I love this pattern as well, but as some comments have pointed out, there is a pitfall of security risk (you don't know where your API key is going). I think it would be really cool if more services let you cap API key usage, so it's almost like a virtual credit card number. I could then put in API keys to sites without worrying and knowing that at most, I can lose, say, $10 or something.
[ Parent | on HN ]
Re:Claude's API now supports CORS requests, enabling client-... by simonw on Friday August 23, 2024 @02:17PM (#41331529)
This is absolutely the thing I most want: it should be trivially easy to create a dedicated API key with e.g. a $5 maximum spend that I can share with a "bring your own key" tool.

Being able to issue those via an OAuth flow as opposed to copy-and-paste would be nice, but the fundamental thing I want is per-app spending limits.

[ Parent | on HN ]
Re:Claude's API now supports CORS requests, enabling client-... by tabgram on Friday August 23, 2024 @03:16PM (#41332141)
Obviously you aware, but let me still say it: openrouter is for me a trivially easy way to create dedicated keys with max limit https://openrouter.ai/credits or am I missing something?
[ Parent | on HN ]
Re:Claude's API now supports CORS requests, enabling client-... by bilater on Friday August 23, 2024 @03:37PM (#41332335)
oh this is interesting thanks for linking gonna check em out
[ Parent | on HN ]
Re:Claude's API now supports CORS requests, enabling client-... by jameshart on Friday August 23, 2024 @05:17PM (#41333191)
This is pretty much exactly what an oauth2 flow is. You generate a single-use-specific token and constrain it with the limited permissions you choose. If a site wants to offer an oauth token flow where users can put a time or credit usage limit on the token they absolutely can do so.
[ Parent | on HN ]