The UX could be so much better and more secure. This type of use case is a perfect fit for OAuth2.
Current UX:
1. User hits your app
2. You tell them to go to Anthropic and generate an API key. You'll probably need to give them instructions on how to do so, which will become outdated over time as Anthropic makes changes to their website.
3. User goes to Anthropic and generates an API key
4. User manually navigates back to your app and pastes the key
OAuth2 UX:
1. You redirect the user to Anthropic
2. The user approves your app getting access
3. Anthropic redirects the user back to you and your app starts working.
For the life of me I don't understand why orgs don't implement OAuth2 for basically everything. Yes it is more complicated on the developer side, but that's for good security reasons. And it isn't that bad, and well worth the moderate time investment.
Current UX:
1. User hits your app
2. You tell them to go to Anthropic and generate an API key. You'll probably need to give them instructions on how to do so, which will become outdated over time as Anthropic makes changes to their website.
3. User goes to Anthropic and generates an API key
4. User manually navigates back to your app and pastes the key
OAuth2 UX:
1. You redirect the user to Anthropic
2. The user approves your app getting access
3. Anthropic redirects the user back to you and your app starts working.
For the life of me I don't understand why orgs don't implement OAuth2 for basically everything. Yes it is more complicated on the developer side, but that's for good security reasons. And it isn't that bad, and well worth the moderate time investment.