The security problem of openaiApiKey in the server

[Henry910]

How can I send openaiApiKey to the server through POST instead of writing API-KEY to the environment variable in advance?
If someone knows the Chatgpt service provided by my server, can he also send a request to my server to use my balance?
Thank you for your help.

[waylaidwanderer]

Hey, with 1.28.0, you can now leave settings.chatGptClient.openaiApiKey blank and provide it in the POST request like this:

{
    "message": "hi",
    "clientOptions": {
        "openaiApiKey": "sk-xxxxxxx"
    }
}

Please make sure to read through the documentation for the clientOptions parameter in the readme's Endpoints > POST /conversation section.

Additionally, you should read through the comments for perMessageClientOptionsWhitelist in settings.example.js to ensure you only whitelist the options you want users to be able to override (otherwise they can do things like change the model or enable the client's debug mode, etc.).