Hello OpenAI team,
I would like to suggest a feature that could open the OpenAI API to a large category of small, privacy-friendly and serverless applications that currently cannot reasonably use OpenAI.
I am developing a small German-language learning PWA hosted entirely on GitHub Pages. There is no backend, no cloud database and no user account system. User data remains exclusively on the user’s device.
The application also has optional AI features. The current implementation uses Anthropic’s API in a BYOK (Bring Your Own Key) model: each user creates and pays for their own API key, enters it into the application, and the key is stored locally on their device. I would like to offer OpenAI as an alternative provider, but OpenAI currently does not support exposing API keys in client-side/browser applications.
I understand the security concern. However, I believe there is a significant middle ground between “never allow API keys in a browser” and “allow unrestricted API keys”.
For example, OpenAI could introduce a dedicated type of restricted API key intended specifically for client-side/BYOK applications, with mandatory safeguards such as:
- A hard maximum spending limit per key (e.g. $5, $10, or another user-defined maximum).
- The ability to restrict the key to specific models.
- Strict rate and/or token limits.
- No access to account administration, billing, projects or other account resources.
- Clear indication that the key is intended for client-side use and carries additional security risks.
- Explicit user acknowledgement of those risks before the key is activated.
- Easy revocation and regeneration.
- Ideally, the ability to create a separate “sandbox/BYOK” key that is completely isolated from the user’s other API credentials.
This would make the model particularly useful for:
- Small educational applications
- Personal projects
- Open-source applications
- Static PWAs
- Hobby projects
- Prototypes
- Developer tools where users bring their own API key
In my particular case, the application developer would never pay for or share the user’s API usage. Each user would create their own OpenAI account/API key, add their own payment method/credits, and accept responsibility for protecting that key.
The current restriction effectively means that a small application with 10 or 20 users has to introduce a backend infrastructure solely to protect a key that the application developer does not even own or pay for. This adds unnecessary architectural complexity and costs for exactly the kind of small projects where OpenAI could otherwise gain additional API customers.
I believe a restricted client-side BYOK credential could solve the security concern while still giving OpenAI full control over the maximum financial exposure.
Even a deliberately conservative first version — for example, a key limited to $5 of lifetime usage, a small number of models and strict rate limits — would already be extremely useful.
I would be very interested in seeing this considered as an API product feature.
Thank you,
TomaU