Unverified50% confidenceFactExact time
Network credentials use a proxy injection model: what the program reads is a placeholder, and the proxy managed by OpenAI replaces the placeholder with the real credential at port 443 of the HTTPS request to the target domain.
1
Sources
50%
Confidence
Long-term
Relevance
10/16/2026
First Seen
Sources
Related Entities
Related Claims
VerifiedOnce an API Key is leaked, an attacker can make unlimited API calls from anywhere in the world as the key holder, and the server cannot distinguish legitimate calls from unauthorized ones.70% similarUnverified在标准HTTPS通信模型中数据端到端加密，但中转服务器作为代理必须先解密用户请求再转发给上游API，因此平台技术上具备读取和留存所有对话内容的能力69% similarUnverified由于服务器不记录调用方身份的历史状态，单凭一串API Key字符串就足以代表完整的身份权限，Key一旦泄露即可被无限制滥用69% similarUnverified第三方接口中转在网络架构上属于反向代理模式，即便传输层使用HTTPS加密，中转服务器自身仍可完整读取解密后的请求体67% similarUnverified通过非官方平台获取的API密钥，其请求经中间服务器转发，对话内容、代码、提示词可能被中间方记录，存在敏感数据泄露风险67% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1049240API
curl https://kongchang.com/api/v1/knowledge/claims/1049240MCP
get_claim(id=1049240)