Authentication options on behalf of a user

[spa]

Hello, I’m looking to create an app using the completions API. It’s pretty straightforward to get it working with an API key.

But, I don’t want to use my API key for every interaction on this app. I’d rather have the user be able to log in and have every request be on behalf of the user. The only (reliable) method I could think of now is to have a user get an API key themselves and store it somewhere the app could read. Is there any other authentication method that I can use for this?

[PaulBellow]

Welcome to the forum.

Bring your own key isn’t supported by OpenAI as far as I know…

OpenAI's "bring your own key" policy

I’m interested in potentially building an application where users can enter their own OpenAI API key into my application and use the service that way. This key may be stored in a database by my application. I’m wondering what is the OpenAI policy on letting users bring their own key? Is there any commercialization challenges and restrictions in doing so? Maybe guidelines on best practices which could be helpful I could check out? Thank you!

[RonaldGRuckus]

What a great idea.

I’ve noticed a lot of free good-hearted services fail out of fear of sharing an API key. To be fair, I recently witnessed a “Avoid moderations endpoint” tool released that somehow makes GPT vulgar. No surprise when people starting noticing their accounts being banned. Some people seem too willing, and others (including myself) too defensive when it comes to the API key.

I would completely support some sort of one-use authentication session instead of an API, which also forces the service to use the moderations endpoint.

User requests key to the hostname, or some unique identifier via OpenAI → User can now use the free product on their own dime using a one-time hashcode with the service → Each completion/entry is forced to carry a moderations hash to confirm that it passed → We now have a safe, secure free service that doesn’t require any useable information, and provides protection against malicious entities

[spa]

Thanks @PaulBellow! I was looking for a similar post earlier but could not find anything

[spa]

@RonaldGRuckus Yeah, I’m very hesitant to share my own key. I know the OAuth2.0 framework supports flows to send requests on behalf of a user. I’ve used it through Microsoft in the past. I guess I was hoping some solution already existed that I didn’t know about.

I was just reading through the post linked above, and I’m wondering if this response was talking about something similar.

[ruby_coder]

@spa

Is there any other authentication method that I can use for this?

No. Not at this time.

The OpenAI API is only accessible using an API key and there are no published plans that anyone knows of for OpenAI to change this policy and authentication method.

Hope this helps.

[yigitcan]

Thanks for bringing this up. I hope OpenAI will implement something similar as soon as possible.

Both the ChatGPT and the OpenAI APIs would benefit from an oAuth 2.0 Consent setup. From developer perspective; onboarding becomes more seamless. From user perspective, we would have the confidence that we can revoke consent / inspect usage per client.

I would even go further and say this should be the suggested way that third party applications integrate with OpenAI. As a user, I am already paying for an OpenAI subscription. Why can’t I utilize the same account with different websites / tools?