Claude's API now supports CORS requests, enabling client-side applications

https://simonwillison.net/2024/Aug/23/anthropic-dangerous-direct-browser-access/

by simonw • 2 years ago

349 156 2 years ago

yuz• 2 years ago

Maybe for internal development, but definitely not for a user-facing app. Making less impactful of a change. But still nice

Kiro• 2 years ago

I'm thinking it enables apps where users can bring their own keys without exposing it to my server.

Yodel0914• 2 years ago

That's what I've done for my chatgpt UI - I store the API key and any other user config in local storage.

OccamsMirror• 2 years ago

That's the only good use of this but I bet people will end up leaking their keys being stupid with it.

panarky2• 2 years ago

The "dangerous" part of "anthropic-dangerous-direct-browser-access" is because you should never expose API keys in client code.

unglaublich• 2 years ago

Unless it's the client's keys.

Or keys obtained on the client's behalf.

ozfive• 2 years ago

Even using the client's keys it would be a good idea to give a disclaimer that their key may be stored (If that is the case) and can be accessible through nefarious means. People are very susceptible to phishing attempts etc. and this sort of business model (where you have the client supply the key and store it through the browser is a slippery slope.

creesch5• 2 years ago

Generally speaking that is what OAuth should be used for with clearly defined scopes and insights in what apps are making use of the API through your account. Not an API key with full access and no limitations.

With openAI and other providers, I know you can limit the budget for a key, but that is still a pretty broad scope you are left with.

jdenning• 2 years ago

I must strongly advise against making direct API calls from a browser, as it exposes your API key and violates best practices for API security.

Hilarious that even the LLM warned against this

creesch5• 2 years ago

Bit of an odd warning though, considering how half the internet works. I suppose the warning is missing some context. It is a bad idea to give your API key directly to web services you don't know or trust. For those situations, OAuth with fine-grained scopes would be more suitable.

If it is just your own web app, and you have an input for a key, I don't really see the issue.

jillesvangurp3• 2 years ago

Depends how you do this. If you allow users to configure their own key, they basically end up using https to communicate the API key directly to the party that issued it. Not much of a risk of leakage there and very common with e.g. browser and editor extensions written in javascript. In a browser, you need the server to be setting CORS headers for this to work.

Provisioning some key to your users so they can then pass it on via a client side API call would indeed be more risky. Don't do that. But if it's their own key it's all fine.

axegon_• 2 years ago

I see three problems with this:

1. From a product perspective, this is like going to a restaurant to get dinner but having to bring your own kitchen utensils, food and cooking your dinner yourself.

2. Anything running in a browser is inherently insecure - what's the guarantee that the site where you're pasting your key doesn't have some incredibly stupid security flaw and your key gets leaked?

3. Even if there are no vulnerabilities, you're still pasting your code in a random form somewhere on the web. All it takes is an ajax call or a websocket and someone, somewhere has your key.

afiodorov4• 2 years ago

I love making web apps where users bring their own keys. This approach combines the best of both worlds: the convenience of distributing executable files and the benefits of open source. So far, I have developed two web apps:

1. A live transcription and translation app that uses microphone input. This is useful for watching proprietary content and facilitating communication.

2. An app that translates SRT subtitles into various languages.

I opt for the "bring your own keys" model for two main reasons:

1. Low maintenance: As a professional software developer, I already maintain a lot of software, and the last thing I want is to maintain my side projects. My goal is to write and distribute these apps so they continue working without requiring constant attention from me.

2. Low cost: This model allows me to distribute the apps without ads. By having users provide their own keys, I can keep operational costs down and avoid the need for monetization through advertising.

This approach enables me to create and share useful tools while keeping both my maintenance burden and user costs to a minimum.

jillesvangurp3• 2 years ago

Interesting; I've build a similar application for assisting with the translation of localization files (mozilla's project fluent) and for the same reason as well.

I build this stuff for fun; and because I needed something like it. I don't expect to be making money of it so I want to minimize operational overhead and hassle. So it suits me to not have to build and run an application server for this; even though I'm well capable of building such a thing.

It's available here: fluent-ai.jillesvangurp.com if people want to play with this. It uses openai in the browser and probably can work pretty easily with claude as well. Bring your own key. It's all open source if people want to play with this.

KeplerBoy3• 2 years ago

Could ads even support such AI heavy use cases?

I'm kind of out of touch with current AI API pricing and ad revenues, so i'm curious how the economics work out.

InsideOutSanta3• 2 years ago

Yes, we're now at an inflection point where this is starting to become possible. gpt-4o mini costs $0.15 per 1 million input tokens, and $0.60 per 1 million output. This is cheap enough that it can, at least in some cases, be funded by ad impressions.

Of course, the implications here are mixed. If you want to build an ad-supported tool that actually helps people, that's great. But it also means it now makes clear financial sense to fill the web with AI-generated garbage with the assumption that that ad impressions will pay for it.

bboygravity2• 2 years ago

I do the same now for a firefox extension I wrote (automatic form-filler that works way way better than anything else out there).

So it's also "bring your own keys" but then how do you monetize at all?

I personally don't like "bring your own keys" at all from a user-friendlyness perspective. It means that you exclude the vast majority of potential users, because they don't know what that even means. Even "create an account" is more user friendly.

dvdkon• 2 years ago

"Bring your own keys" can mean a "log in with OpenAI" button. Having users navigate through a third party's arcane dev portal isn't a good experience, but that third party can make it painless for users if they so choose.

TeMPOraL9• 2 years ago

So it's also "bring your own keys" but then how do you monetize at all?

TypingMind.com is a "bring you own API key" (obviously, being a LLM frontend), that's also successfully monetizing users. The secret is that it's actually a very good product; until recently, it was far ahead of the official tools (I mean, they had plugins for like half a year before OpenAI started talking about "GPTs"), so paying for the license feels worth it (definitely was, when TypingMind was strictly better than ChatGPT Plus subscription).

It's also not a subscription - another reason "bring your own keys" apps are interesting, because you likely already have a paid subscription with the API vendor; adding another one on top of that needs some good justification.

Anyway, "bring your own key" users are a different market from general audience, and unlike the latter, it isn't already saturated with fly-by-night garbage and scam extensions, so you can both charge more for that feature, and have smaller costs marketing it.

vineyardmike2• 2 years ago

So it's also "bring your own keys" but then how do you monetize at all?

Why do you need to monetize? The original comment you replied to talked about making something for the world and sharing it. They said they didn’t want to maintain it, they didn’t want to be obligated to care for it. You can’t make that choice if people are paying you (or at least shouldn’t…).

I don’t understand the BYOx use case for a monetized product. If you’re BYO api, you’re essentially missing the opportunity to monetize a spread on API requests. The more a customer uses your product (because it’s good), the more you’d make. That’s the best case scenario because it means everyone is finding value.

purple-leafy3• 2 years ago

Bring your own keys to minimise costs, you can still charge a subscription or one off charge for the base service if it’s a SaaS extension or similar

BrandiATMuhkuh• 2 years ago

What's the name of the extension. I was looking for something like this recently

purple-leafy3• 2 years ago

I do the same, I make chrome extensions and my most recent extension uses a byo api key model for calls to an LLM.

Means I can offer the service for free and not worry about hosting keys, serving ads, and storing users keys in a db. Everything can be done client side.

Good to hear I’m not alone in the endeavour, what software are you building?

afiodorov4• 2 years ago

I made two one-page react apps

https://www.livetranslate.net/

https://www.subsgpt.com/

Second one is more refined but both are functional.

I was pleasantly surprised somebody made a YouTube tutorial in Japanese about the latter https://www.youtube.com/watch?v=8gAkvZYayEc - feels like retro internet where people share things on their personal webpages.

Curiously the first one also landed me a contracting opportunity for a company that wanted to add live captions to their product and we went live with my help.

I also made a decentralized twitter dapp ages ago but AI apps definitely have had more interest.

shaneos• 2 years ago

I offer both in https://kidzfun.art. If you're non-technical, you can buy packs of 100 images and it uses my key to access Dall-E, or you can provide your own key and pay nothing to me. The vast majority of users go the simpler way, but it's a nice bonus for technical users to just reuse their own key. The difference with your approach is that I store an encrypted copy server side as I do all the AI generation on the server.

alex_suzuki• 2 years ago

I don’t understand why you’re being downvoted. I think this is a reasonable approach. If you want convenience, you pay for it – otherwise it‘s BYOK.

nfriedly• 2 years ago

I put together https://nfriedly.github.io/contributor-locations/ a while back, which has the same idea except that the access token is optional. GitHub's API provides a small number of request without one, but adding an API key will enable it to do more.

huijzer• 2 years ago

Yes I couldn’t agree more. I wish there was more support for this; like for example a system where users can be sure that the key cannot be stolen by the app.

perpil• 2 years ago

Another benefit of BYOK is it simplifies the implementation. You don't need to spend as much time protecting against the attack vector where they rack up a big bill against your key.

pickledish• 2 years ago

Yeah, I also love this style of web app, for the same reasons you note!

I made https://github.com/pickledish/cardi as a kind of dynamoDB-based bookmark keeping tool in this style :) though I haven't worked on it in a couple of years.

apitman4• 2 years ago

The UX could be so much better and more secure. This type of use case is a perfect fit for OAuth2.

Current UX:

1. User hits your app

2. You tell them to go to Anthropic and generate an API key. You'll probably need to give them instructions on how to do so, which will become outdated over time as Anthropic makes changes to their website.

3. User goes to Anthropic and generates an API key

4. User manually navigates back to your app and pastes the key

OAuth2 UX:

1. You redirect the user to Anthropic

2. The user approves your app getting access

3. Anthropic redirects the user back to you and your app starts working.

For the life of me I don't understand why orgs don't implement OAuth2 for basically everything. Yes it is more complicated on the developer side, but that's for good security reasons. And it isn't that bad, and well worth the moderate time investment.

spyspy• 2 years ago

Devs here often don’t even really understand JWT tokens as evidenced by the hundreds-of-comments deep arguments I’ve witnessed over them.

tsimionescu• 2 years ago

You have to remember that dev time is always at a premium. Even if it takes one week to build OAuth2 support, that's one week delay on other features. It's always a matter of priorities.

serjester• 2 years ago

While this is nice, I don't think the dangers are discussed enough. A user has no guarantee their key isn't just being sent to some malicious third party. Normalizing this seems dangerous because it only takes a couple bad actors.

Sure you could try to get people to issue / delete keys every time they use an online app but it seems unlikely most users will do that.

65102• 2 years ago

The browser doesn't need to facilitate this.

They could generate an application specific key. Could do that every time one uses the application by forwarding though the website issuing the key and back.

I want government id to work like that. You authorize the website on the .gov then the website only gets a key, no further information. The only thing to knows about the key is that each citizen gets to generate one key for each [registered] domain.

65102• 2 years ago

A live transcription and translation app that uses microphone input. This is useful for watching proprietary content and facilitating communication.

It would be funny to transcribe someones speech, improve the grammar and play it back in their own voice.

bilater2• 2 years ago

I love this pattern as well, but as some comments have pointed out, there is a pitfall of security risk (you don't know where your API key is going). I think it would be really cool if more services let you cap API key usage, so it's almost like a virtual credit card number. I could then put in API keys to sites without worrying and knowing that at most, I can lose, say, $10 or something.

simonw6• 2 years ago

This is absolutely the thing I most want: it should be trivially easy to create a dedicated API key with e.g. a $5 maximum spend that I can share with a "bring your own key" tool.

Being able to issue those via an OAuth flow as opposed to copy-and-paste would be nice, but the fundamental thing I want is per-app spending limits.

jameshart2• 2 years ago

This is pretty much exactly what an oauth2 flow is. You generate a single-use-specific token and constrain it with the limited permissions you choose. If a site wants to offer an oauth token flow where users can put a time or credit usage limit on the token they absolutely can do so.

ianbicking• 2 years ago

OpenRouter.ai does this pretty well. It has a pretty reasonable flow. It supports enough free models that you can do at least _something_ without a person having to pay anything (even if quality is a bit iffy). They have user-set spending limits, and each key is bound to the service. Their privacy policies seem decent.

The other option is Gemini, which has enough free credits to really be free for any small app. Unfortunately you can't use that through OpenRouter, you need your own developer account to be able to take advantage of Gemini's free offering.

mattrighetti• 2 years ago

I’ve always thought this would be a cool thing to offer, one thing that I’ve asked myself though is why should I trust you to use my key? Who guarantees that you’re not going to abuse it or use it in an inefficient way?

I’m unfamiliar with how these keys are priced but I guess they still use number of tokens that you input? What happens if one day your software has a bug that sends 1k tokens multiple times and I get charged for it because I’ve used my key?

Note that this is not a complaint and I would definitely love a “bring my key to use for free” tier, just a legitimate question that I asked myself from time to time.

On the other hand, I trust you very much in doing your best work to avoid any bug like the one I’ve presented above and squeeze every little penny out of your key to maximise earnings.

Finally, how do you make people entrust you with their keys?

afiodorov4• 2 years ago

The browser runs the code, which is open-sourced. You can look at the network tab of the debugging console or isolate the browser completely by sand boxing it. I agree that UX can be improved but that’s more on the browser side.

saagarjha2• 2 years ago

Web security noob here. Why does CORS even exist? The fact that a website can’t make a request to another website unless that domain likes it is kind of insane to me. Everyone in the comments here is going on about how maybe the user’s API key gets leaked by a malicious application or whatever but, like, when I write software that isn’t in the browser I can just send a request to anyone without restrictions and as far as I can tell the world has not ended. Why is the browser any different?

barrkel• 2 years ago

CORS - or specifically, not permitting cross-origin requests by default - is for preventing CSRF, cross-site request forgery. In particular if the user's credentials (cookies) are passed along with a request to a third party site, then the first party site can act as the user with the user's authority. In other words, evil.com could e.g. send emails on your behalf by making direct requests to your email provider's web interface.

saagarjha2• 2 years ago

Ok but like why would you pass cookies along

Thorrez9• 2 years ago

That's not really correct.

CORS and the same origin policy don't protect against CSRF attacks by default, at least if we're using the standard definition of CSRF attacks.

An attacker can still "send emails on your behalf by making direct requests to your email provider's" HTTP API even with CORS and the same origin policy in their default settings, as long as your email provider doesn't implement CSRF protection (e.g. anti-CSRF token or Origin header checks). That's why all state-changing HTTP handlers need to implement CSRF protection.

tommica• 2 years ago

Simple, if you have an iframe pointing to http://foo.test/deletesite.php, without cors that request will be done, with cookies and everything, without the user being aware of it.

EE84M3i• 2 years ago

AFAIKR you don't need CORS for framing, or making cross origin GET or POST. You only need it to read the response of a cross origin request and setting certain request header and body etc.

For example you can make a cross origin GET with an img tag, and a cross-origin POST with a form tag and some JavaScript.

Thorrez9• 2 years ago

That attack you mention is a CSRF attack. CORS doesn't really protect against that. That exact attack you mention is possible if foo.test doesn't implement CSRF protection. CORS doesn't automatically provide CSRF protection.

eejjjj82• 2 years ago

CORS is designed to protect the server data. It's a tool that gives servers a control mechanism to tell browsers "who can access my data".

Imagine that your banking website used a standard JSON+REST API with cookie based authentication to trigger & validate a transaction request.

When a request to `fetch` or XMLHTTPRequest is made from ANY site, the browser will still populate cookies for 3rd party sites.

So without CORS, then someone might be able to create a landing page, which in the background triggers a `fetch` or `ajax` request to your bank's transaction endpoint. For 99.999% of people this wouldn't be effective because they are probably not a customer of this bank and are not logged in at the time of the request. But for some very tiny fraction of users, the browser would be tricked into populating the Cookie header from a previously created session in a different tab and would send this request.

The Origin header in the CORS preflight is a signal from the server to the browser that 'yes, this request is safe for you to construct'. This way the browser doesn't let the malicious web page "trick it" in the first place to send the bad request.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

notpushkin4• 2 years ago

When a request to `fetch` or XMLHTTPRequest is made from ANY site, the browser will still populate cookies for 3rd party sites.

I think this is the problem here? Just send the request without cookies if CORS doesn't allow it.

(I also think third-party cookies were a mistake in general, and it would be a good thing if they were removed. There were some plans but well, Google.)

Thorrez9• 2 years ago

So without CORS, then someone might be able to create a landing page, which in the background triggers a `fetch` or `ajax` request to your bank's transaction endpoint. For 99.999% of people this wouldn't be effective because they are probably not a customer of this bank and are not logged in at the time of the request. But for some very tiny fraction of users, the browser would be tricked into populating the Cookie header from a previously created session in a different tab and would send this request.

Are you talking about an attack where the attacker tries to control the victim's bank account by initiating a transfer? That's a CSRF attack. CORS and the same origin policy don't prevent that attack by default. The browser will still send the request the request populating the cookie. The same origin policy will prevent the evil site from reading the response, not from making the request. To protect against this attack the bank needs to implement CSRF protection (e.g. checking the Origin header).

treve• 2 years ago

This is mostly correct, but one thing that's worth pointing out is that CORS doesn't protect anything, but it 'loosens' the protection that the browser has by default. The S in CORS stands for sharing, not security.

BrandoElFollito• 2 years ago

There is a good explanation here: https://stackoverflow.com/a/29167709/903011

breck• 2 years ago

A soldier gets back from the front and gets a job in IT moderating internet comments.

A few months later he calls his CO and asks to be sent back to the front.

The CO asks "why would you want to do that?"

He replies, "there's a lot less fear over there."

TeMPOraL9• 2 years ago

You get downvoted, but that's pretty much spot on. I've wasted many days of my life trying to navigate around security in the browser and HTTPS everything, mostly unsuccessfully, and I only see increasingly insane lock-downs appearing as time goes on.

It feels like that the only mode of use of a computer that's allowed by security-minded folks is being a company selling shit on-line, or a customer of one. Try anything like making a simple browser UI to use some internal API, even on localhost, and you quickly end up running your own certificate authority, CORS proxy and having to buy a domain.

I mean, the very concept that the only right way to do HTTPS for internal tools is to have a public certificate on a public Internet domain, thus having to pay third parties and leaking information via certificate transparency logs, is insane when you're just doing your own stuff on your own LAN, and need to use a browser (entirely locally) or touch anything on the Internet.

Thorrez9• 2 years ago

The fact that a website can’t make a request to another website unless that domain like it

That's wrong. Any website can make a request to any other website. The same origin policy will prevent READING the response, not making the request. This is to prevent evil.com from making a request to email.com and reading all your emails.

CORS was invented as a way to partially disable the same origin policy for websites that want to allow their responses to be read by other sites. Note that CORS is a way to disable blocking. Most people think CORS blocks things, but that's a misconception. The same origin policy blocks things, and CORS can partially disable it. CORS = Cross Origin Resource Sharing. The Sharing refers to how it disables blocking.

(This is a slight simplification, because I'm ignoring complex CORS.)

kevincox2• 2 years ago

CORS is basically a backwards compatible hack to "fix" the bug that cookies are sent on third party requests by default.

The canonical issue that CORS solves is:

1. I log into my bank. 2. I load an untrusted site. 3. That site does `POST https://mybank.example/transfer` to transfer my money to them.

This works because of the braindead decision to include the cookies obtained in step 1 in the request made in step 3.

But to avoid breaking the web they had to do this "gently". So they did the following:

1. Add the Origin: header so that sites could check for this problem. (opt-in protection) 2. Add CORS for as much as they could without breaking too many existing sites (opt-out protection).

If you are designing a site what you probably want to do is check the Origin header and just set `Access-Control-Allow-Origin: *` (which is better than mirroring the origin as it blocks automatically-added credentials like cookies).

This doesn't fully solve the problem due to the legacy compatibility carve-out in 2 (https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simpl...). But was unfortunately necessary to help hotfix existing sites that were vulnerable while avoiding breaking too much (in which case it would never ship). Notably this carve-out includes HTML <form> POSTs! So if you use regular HTML forms on your site you still need to opt-in to proper protection.

These days most browser partition cookies by top-level origin anyways, so CORS is mostly obsolete. But you can't rely on that.

People will often tell you that CORS is about controlling which origins can see your content. That is mostly false. Because you can easily run a CORS proxy to access any publicly available content. What CORS does is simply prevent implicitly added authentication such as cookies and basic auth from being sent cross-domain by default (except for the carve out)

Thorrez9• 2 years ago

I agree with how you describe the behavior, but the terminology you use differs from how I understand things.

The canonical example you give for something CORS and the same origin policy protect against isn't even protected against by default (as you mention), because it requires additional opt-in protection from mybank.example . Why not use a canonical example that is protected against by default? Like evil.com reading all my emails by making a request to email.com ?

You describe CORS as blocking things. I think it's the same origin policy that blocks things, and CORS (Cross Origin Resource Sharing) unblocks things ("sharing"=unblocking).

simonw6• 2 years ago

Lots of replies here talking about cookies and CSRF, but a bigger concern in my opinion is intranets.

If you work somewhere with a network access based intranet you might have eg a private wiki at https://wiki.internal-corp/

Without CORS, anyone from your company visiting a malicious external website could have data stolen from that “private” intranet site using fetch()

apitman4• 2 years ago

CORS exists to keep us humble. The first time you think you understand it, your journey has only just begun.

thiht• 2 years ago

There are always some mild arguments that CORS is better that nothing, but honestly your intuition is right, CORS is absolute nonsense.

londons_explore• 2 years ago

if you embed your API key in your client code, anyone with access to that site can steal your API key and use it to make requests on your behalf.

Great. Anyone know a search engine to find these 'free usage' keys?

notpushkin4• 2 years ago

I think https://publicwww.com/ could do the trick?

_pdp_• 2 years ago

I don't see this being a problem in situations where a customer / user can bring their own keys. The actions happens on the client-side and as long as the device or the website are not compromised it is all good.

However, this is definitely increasing the attack surface where a developer may decide for whatever reason to use production keys client-side without proxying the requests as they would normally do. I can see this being done out of convenience and performance reasons not taking into account security considerations.

vdfs• 2 years ago

Also, this was always possible using a simple proxy that directly send requests to their API

riquito• 2 years ago

as long as the device or the website are not compromised it is all good

But that is THE problem. You are making yourself a huge target. The more users you have the most likely someone will attempt to hack you to use all those keys. The "client side" point is moot because the code that uses those keys comes from the server, once that's compromised all hell is loose.

ikekkdcjkfke• 2 years ago

Notnpossible to generate a limitee key in 2024?

me551ah• 2 years ago

For the use case of user bringing their own keys, oAuth is a much better solution. Some developer is going to hardcode their actual keys on the frontend and find out the hard way. OAuth is a more dumb-proof solution

judevector• 2 years ago

Great to see CORS support added! This will make integrating Claude's API into client-side apps much smoother.

wonderfuly• 2 years ago

I'm really glad to see this. Last week, when I upgraded the Anthropic TypeScript SDK from 0.23.0 to 0.26.0, my browser extension (chathub.gg) broke because they completely banned the use of this SDK in browsers!

ramonverse• 2 years ago

It was about time. We definitely wasted a bunch of time making a server side arch for pretzelai.app because claude (unlike openai) didn't have dangerouslyAllowBrowser option. No idea why this took them so long

samstave3• 2 years ago

>why this took them so long

They were trying to have Claude code it up - but every time it got close to working, Claude would lose context and hallucinate and the code would break.

Been there too many times with Good Ol' Claude.

meiraleal• 2 years ago

funny but this proves that claude is now good for code?

e12e2• 2 years ago

It’s fine for internal tools exposed to trusted users,

No, not really?

or you can implement a “bring your own API key” pattern where users supply their own key to use with your client-side app.

This is a valid use-case, even if it breeds unsafe patterns (just allow random site/code on the internet impersonate you and spend money on your behalf).

But it's not really worse than how 3rd party integrations generally do that anyway.

rvnx• 2 years ago

They could do a system where you can create one API key with a budget for a site, and that's it, that would be enough, but until they have that budget system, it's not really a good approach

simonw6• 2 years ago

Why isn’t it OK for internal tools with trusted users?

It’s functionally the same as saying “hey coworker, here’s an API key you can use, it’s billed to the company”.

e12e2• 2 years ago

I suppose - my general reaction is that use of such magic api keys are difficult to audit, revoke etc - and there's the constant risk they will leak.

ripped_britches• 2 years ago

I’m not sure why they don’t support JWTs so we can mint limited user-specific keys instead of exposing the master key

Supabase is a great example of how to use claims to give safe client side access

jasondigitized• 2 years ago

This would unlock so many interesting use cases and protect the developer from getting a huge bill. Let me basically resell your API and abstract away any complexity to the end user. I'll charge use some % markup on top of what I pay Claude.

MeetingsBrowser• 2 years ago

How are people using the Claude API as individuals?

Officially, individuals are not allowed to use the API.

https://support.anthropic.com/en/articles/8987200-can-i-use-...

buildbot• 2 years ago

Everyone’s their own Sole Proprietorship?

LeoPanthera• 2 years ago

Huh! That's a surprise. Especially as OpenAI has no problem with it.

MitchellCash• 2 years ago

I’m going to out myself, but you just do it anyway…

simonw6• 2 years ago

I asked someone at Anthropic about it and it turned out to be a stale page, it’s updated now and says:

“Yes, individuals and hobbyists are welcome to use the Anthropic API.”

zczc• 2 years ago

They have just updated the FAQ:

Can I use the Anthropic API for individual use?
[Updated yesterday]
Yes, individuals and hobbyists are welcome to use the Anthropic API. However, please note that use of the API is subject to our Commercial Terms of Service, regardless of whether you are an individual or representing a company.

Previously:

No. Access to the API is subject to our Commercial Terms of Service and is not intended for individual use.

orenlindsey• 2 years ago

I mean, you could have just made a quick proxy with a little express server to get around this anyways. But I shouldn't be complaining, it's good that they did this.

Edit: of course, I just realized that people may not want their api key being sent to your server.

allanren• 2 years ago

Claude is growing strong with these new features

hagope• 2 years ago

Anthropic and all the AI vendors need to implement "Login with ___" allowing users to trust sites to use their own AI resources, similar to how Dropbox allows 3rd party access to the User's storage. Most users don't want to bother with generating and loading API keys, nor can they manage it safely.

pzo4• 2 years ago

Agree. I wish OpenRouter did something like that so that we can have only 1 vendor and app can decide themself what AI API want to use. Then user don't need to have digital wallets topped up with money for 3+ different AI vendors. Basically you want to have something similar to crypto wallet that you can easily fill with money and authorize apps.

Claude's API now supports CORS requests, enabling client-side applications

Related Stories