tonym/names
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

docs: BYO-key section no longer claims the app holds no credential

Browse Source
This commit is contained in:
Tony Moon
2026-08-16 18:27:48 -05:00
parent c307a75880
commit 9cf378e15a
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
README.md
View File

@@ -78,9 +78,8 @@ HMAC-signed cookie (`names.session`). There are no user accounts in this app.
Optional. `/settings` stores an Anthropic or Gemini key in `localStorage`
(`names.aiKey`) and the browser calls that provider **directly** — the key never
touches our server. Same pattern as `rpo`'s Google Vision key, for the same
reason: the platform has no per-app env tool, and this is a free public tool that
shouldn't hold a metered credential.
touches our server. Same pattern as `rpo`'s Google Vision key. It overrides the
platform path above and works without signing in.
The `anthropic-dangerous-direct-browser-access` header is correct here and would
be wrong in a product that owns the key. The distinction is whose key it is.