Short answerKeep your API key on a server, rate-limit visitors, cap answer length, set spending limits with your provider and tell users the bot is automated. A public bot without these can run up costs fast.
Checklist
- Key secrecy: never put an API key in a web page or app. Use a server that holds it.
- Rate limits: limit messages per visitor per hour.
- Length caps: limit question and answer length.
- Spending limits: set budgets or alerts with your model provider.
- Disclosure: say the bot is automated and can be wrong.
- Scope: tell it what to refuse.
- Monitoring: watch usage weekly at first.
Hosted pages
GPT Migrator hosting keeps your key encrypted on the server and rate-limits chat requests; you should still set a spending limit with your provider. Related: customer-facing bots and key errors.
Need your GPT running again without ChatGPT?
GPT Migrator can host your instructions and files as a standalone chat page for $47 per month. You bring your own OpenAI or Anthropic API key. It answers from your instructions and files and does not run GPT Actions.
See how hosting works