Skip to main content
Your API key sits in your page, so anyone can copy it. Three layers stop other sites and scripts from using it: allowed origins, Turnstile and rate limits.

​
Allowed origins

The API compares the Origin header of each widget request with your list of allowed origins. You set the list in the dashboard, on the Settings page.
An empty list lets any site use your bot and spend your replies. Add your origins before you go live.
When the list has entries, a request with a missing or unlisted Origin gets a 403 reply. The visitor reads this copy:
This website isn’t allowed to use this assistant.
The API also returns the error code ORIGIN_NOT_ALLOWED. Add the site to the list to fix it.

​
Turnstile

Turnstile is the Cloudflare bot check. The widget runs it once for each session, before the first message.
  • The check is invisible unless Cloudflare needs a challenge.
  • The check runs in a small frame from https://api.paperlinkai.com. The frame shows only when Cloudflare needs the visitor to select the check. It shows in the corner of the widget.
  • The frame sends the token only to the page that shows the widget.
  • When your list has entries, the frame runs the check only for a page on the list.
  • The check times out after 30 seconds.
  • The API accepts a token only when the token comes from the Paperlink AI frame for your bot. A token for a different bot does not work.
You do not set up Turnstile for your site. Any site on your allowed origins can use the check. This is also true when another site shows your page in a frame, for example a theme editor preview. A check can fail in two ways. If the check fails in the visitor’s browser, for example it times out or does not load, the visitor reads this copy:
We couldn’t verify this browser. Refresh the page and try again.
If your page is not on your allowed origins, the frame refuses to run the check. If the API rejects the token, it returns a 403 reply. In both cases, the widget shows the allowed origins copy:
This website isn’t allowed to use this assistant.
For these cases, check that your allowed origins list includes the exact origin of the page.

​
Rate limits

Two limits apply to each request. A request over a limit gets a 429 reply with the header retry-after: 60. The visitor reads this copy:
You’re sending messages quickly. Wait a moment and try again.

Content Security Policy

Set the CSP directives that the widget needs.