DEV Community

Chad Dyar
Chad Dyar

Posted on

Comment: Claude and React Chatbot Security Fix

Good walkthrough for getting started. One flag worth raising: the dangerouslyAllowBrowser: true option exposes your Anthropic API key in the client bundle. Anyone who opens dev tools can grab it and run up your bill.

The production pattern is a thin Express proxy. Your React frontend hits /api/chat instead of the Anthropic API directly. Key stays server-side, you can add rate limiting, and it costs about 10 extra lines of code. I built a chatbot widget this way (React + Express + Claude API) and it's been solid in production.

Top comments (0)