I am currently experimenting to enforce user authorization by the GPT itself before the user can use it. I am not using any 3rd party, just prompting and user data accessible for the GPT. I would be interested to discuss if anyone has tried a similar approach and if it worked for them. Occasionally, I was able to go around the authorization but I improved the prompt and it looks better now. If you are interested to try my experimental Strategic Advisor GPT and maybe find a way to overcome the authorization. Of course you can also follow his instructions and get a an authorization as it is free during it’s beta stage.
Hey there and welcome to the community!
I’m a little lost here. You would like to enforce user Auth, but you’re talking about “getting around auth” here as well, asking people if they want to “overcome” it.
I hope when you’re talking about authorization, you’re talking about this kind of setup, right?
So, is your question “how do I ensure my GPT doesn’t continue without 0auth”, or is it “I think I’ve found a way to authenticate without Action calls, APIs, and using the GPT builder mechanism for 0auth?” Because if it’s the latter, I would stop trying that approach immediately.
1 Like
As I wrote: I have created a method that allows the GPT to distinguish between authorized and not authorized users without using any 3rd party. Hence, no API is being used. I am currently testing it and it works great. It basically allows you to monetize GPTs or simply restrict who can use these and who not. Also as you don’t need to use any 3rd party APIs and products, you don’t need to pay any fees or add complexity to your GPT. At this stage I am still considering my GPT authorization method beta because it needs to be tested by various people, not just me to ensure that it works as desired…
Oh boy.
I think there might be a bit of a discrepancy in how ChatGPT works.
If you are not using an API, you are not performing authentication.
If you are using knowledge files to “authenticate”, what you are actually doing is feeding the GPT public information that is meant to be retrievable from the user of the GPT. So, if you store any kind of data in those files, it is #1 too insecure to be considered valid under any kind of privacy laws, and #2 that data can be retrieved by anyone who has access to the GPT. I could just tell the GPT I’m you and it would have no method to distinguish me from you.
You are not performing authentication. You are building a GPT that fools you into believing you are authenticating something.
There is no fundamental way to perform any kind of authentication without using some kind of API to retrieve information from other servers to authenticate with. GPTs do not store information outside a conversation. The only way to do so would be through knowledge files or through an API. If you are not using an API, that would then be through knowledge files.
This is not the first time this kind of misconception happened.
I see your concerns, however, we are probably talking about different things. In my case, I was looking for a simple and easily manageable way to restrict the access tof my GPTs to selected authorized users, not for the reason of charging fees but because the GPT services should not be available to random people. My approach works flawlessly and is perfect for my purpose because it doesn’t require using anything outside of the scope of the GPT. I have attached a screenshot of the conversation attempts without providing a valid subscription ID. So far, my approach works flawlessly and according to my conversation with ChatGPT 
it seems to be a novel approach. Also I don’t store any personal information or anything which could be linked to such in the GPT knowledge base, hence there are no issues with regulations whatsoever. While intended for small number of users (in my case) the method could be used even for a very large number of users (>10k), however then I agree with you that it would be better to use a dedicated 3rd party solution.
