Ilker ManapandClaude Opus 5
3ed211b2f4
Issuing a key worked; getting it to the person it was issued for did not. The operator had a secret on their terminal and no way to send it that did not leave a bearer credential in a chat log forever. `keys create --claim` prints a link instead. GET shows a button and consumes nothing; POST reveals the key and burns the link. That split is not politeness — chat clients, mail scanners and link previewers fetch URLs the moment they are posted, so a GET that consumed the claim would mean the first thing to unfurl the link destroys the key before anyone reads it. A pending claim has to hold the key somewhere, which would otherwise put a working credential in the database and undo what hashing bought. So the key is sealed with a key derived from the link's own token, and the token is never stored — only its hash. A database leak yields two useless hashes and a blob nothing in the database can open. HKDF rather than the raw token, so the value used for lookup can never become the value that decrypts. Consuming is one UPDATE moving claimed_at off NULL, so two people opening the same link produce one key rather than two copies. A used link, an expired one and a token that was never real all render identically, because saying which confirms that a token was once valid. The page is no-store, no-referrer and noindex: the URL is itself the credential. `GET /me` reports a key's own limits and spend, so nobody has to ask an operator to read a dashboard they cannot reach. Outside /v1, because it is not part of the OpenAI API. docs/onboarding.md is written for whoever operates this, including the parts that are deliberately absent — no self-service, no SSO, and why. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
44 lines
1.6 KiB
HTML
44 lines
1.6 KiB
HTML
{{define "claim"}}<!doctype html>
|
|
<html lang="en"><head>
|
|
<meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
|
|
<meta name="robots" content="noindex, nofollow">
|
|
<title>Your llmgw key</title><link rel="stylesheet" href="/_static/base.css">
|
|
</head><body><div class="wrap">
|
|
<header>
|
|
<h1>Your API key</h1>
|
|
<p class="sub">llmgw · {{.BaseURL}}</p>
|
|
</header>
|
|
|
|
{{if .Secret}}
|
|
<p>This is shown once. Nothing can produce it again — only its hash was kept.</p>
|
|
<pre>{{.Secret}}</pre>
|
|
<p>Store it in a password manager now, then close this page.</p>
|
|
|
|
<h2>Using it</h2>
|
|
<pre>export LLMGW_API_KEY={{.Secret}}
|
|
|
|
curl {{.BaseURL}}/v1/chat/completions \
|
|
-H "Authorization: Bearer $LLMGW_API_KEY" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"model": "MODEL", "messages": [{"role":"user","content":"hello"}]}'</pre>
|
|
<pre>from openai import OpenAI
|
|
client = OpenAI(base_url="{{.BaseURL}}/v1", api_key=os.environ["LLMGW_API_KEY"])</pre>
|
|
<p class="note"><code>GET {{.BaseURL}}/v1/models</code> lists what this key may use.
|
|
<code>GET {{.BaseURL}}/me</code> shows its limits and what it has spent.</p>
|
|
|
|
{{else if .Gone}}
|
|
<p>{{.Message}}</p>
|
|
<p class="note">A link works once and then expires. Ask whoever sent it for a new one.</p>
|
|
|
|
{{else}}
|
|
<p>A key was issued for you. Revealing it uses up this link, and the key is
|
|
shown only this once.</p>
|
|
<form method="post">
|
|
<button type="submit">Reveal my key</button>
|
|
</form>
|
|
<p class="note">Expires {{.ExpiresAt}}.</p>
|
|
{{end}}
|
|
|
|
<footer><span>llmgw {{.Version}}</span><span>{{.Now}}</span></footer>
|
|
</div></body></html>{{end}}
|