EDIT: okay, according to replies there is more than meets the eye
There is an undocumented model name that you can use to access it via the API.
Everyone using this proxy needs to provide an OpenAI ChatGPT access token to the server. Let me break this down:
Using the ChatGPT npm package enables an opaque third party access to your credentials to use ChatGPT — or exactly what a botnet / social media manipulation operation would need / want for a convincing bot. They just have to distribute load among all the active access tokens they’ve collected from users.
DO NOT use this library.
DO NOT trust code from authors who either don’t see this obvious vector or are in on it.
To recommend using an opaque third party proxy with no encryption is not acceptable. This lets someone peep into your conversations with the bot on top of the other malicious uses with credential hijacking. And while OpenAI is peeping as well, they are at least using the data to advance AI and most researchers have a deep relationship with the ethics of their field.
Here is the repo in question: https://github.com/transitive-bullshit/chatgpt-api
And also HTTPS is still sent as plain-text. Cert authority in itself doesn't have the keys to decode the text, it just an authority to show the plain-text, but all along, it was a plain-text.
The cert authority simply signs a cert saying “this public key belongs and is controlled by the owner of this domain name”. Since we both trust the cert authority, that signature allows us to prevent mitm attacks.
From there, we can do a Diffie-Hellman key exchange and derive our secret key for encryption / decryption.
That is secure and is the backbone of the internet today. It allows all of us to send messages to an intended recipient without worrying about other parties prying into our business.
A proxy introduces an unnecessary and unvetted third party into an exchange. There is significant financial and political motivation for hijacking sessions for higher access to the chatbot & future versions of it. It is not a good pattern to make a habit of.
I used to work professionally for a Cybersecurity company in the past for just 3 years, it was just a short tenure, so my views are plausible.
I have design MITMA boxes for WIFI and HTTPS (For capturing/understanding botnets in honeypots), so I've seen how plain-text HTTPS are. (But again, I am wrong, as I am speaking from experience.)
It doesn’t matter in any case as OpenAI released the ChatGPT official API, so the original post is irrelevant. That package will transition to the official API and be should be usable.
However, future updates will have a configuration to be able to skip REPLICATE, or choose to use a paid OpenAI model.
Looks like the amount of data that is sent is capped:
https://github.com/jjuliano/aifiles/blob/main/.aifiles.sampl...
Also, take note, the maximum payload for OpenAI is 4kb, so the app will just throw an error when it exceeds 4kb.