From 9cf378e15ac540480310b53c0b2b6e5ee8143a49 Mon Sep 17 00:00:00 2001 From: tonym Date: Sun, 16 Aug 2026 18:27:48 -0500 Subject: [PATCH] docs: BYO-key section no longer claims the app holds no credential --- README.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index c501c02..495e5fc 100644 --- a/README.md +++ b/README.md @@ -78,9 +78,8 @@ HMAC-signed cookie (`names.session`). There are no user accounts in this app. Optional. `/settings` stores an Anthropic or Gemini key in `localStorage` (`names.aiKey`) and the browser calls that provider **directly** — the key never -touches our server. Same pattern as `rpo`'s Google Vision key, for the same -reason: the platform has no per-app env tool, and this is a free public tool that -shouldn't hold a metered credential. +touches our server. Same pattern as `rpo`'s Google Vision key. It overrides the +platform path above and works without signing in. The `anthropic-dangerous-direct-browser-access` header is correct here and would be wrong in a product that owns the key. The distinction is whose key it is.