logoalt Hacker News

simfinii • today at 7:49 AM • 1 reply • view on HN

We allow end users to add API keys directly via the alter connect SDK. If the API key needs to be shared then developers can map it on their end using the grant ID abstraction that we provide. Feel free to go through the docs here: https://docs.alterauth.com/concepts/credentials/

Replies

verdverm • today at 5:51 PM

> We allow end users to add API keys directly

This seems like a bad idea to me these days. Companies doing this make themselves a target and then get hacked like OpenCode. Customer accounts get drained or bills run up.

Run your own gateway behind a firewall / vpn. I personally use GoModel + Tailscale.

https://news.ycombinator.com/item?id=50133401 (OpenCode hacked story)