Developer

Keys are issued per chatbot, in the AI Chatbot Builder. Steps:

1. Open the Chatbot Builder and configure your bot (name, greeting, personality, colours).
2. Publish it — you'll be asked for a name and email so we can host the embed.
3. Open the Embed keys panel and click Create key.
4. Copy the key (it looks like gvz_pk_…) and the ready-made snippet.

Publishable, not secret. An embed key is designed to sit in your page's HTML. It cannot read your system prompt, your account, your other chatbots or any private data — it only identifies which embed a request came from, so we can rate-limit and trace abuse per website. Lock it to your own domains and rotate it any time.

Paste this before </body> on any page:

<script
  src="https://gatavaseai.lovable.app/chatbot-widget.js"
  data-gatavase-chatbot="YOUR_CHATBOT_ID"
  data-gatavase-key="gvz_pk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  defer></script>

Optional overrides (otherwise your saved configuration is used):

data-position="bottom-left"   <!-- bottom-right | bottom-left | top-right | top-left -->
data-size="large"             <!-- small | medium | large | full -->
data-title="Talk to Sales"
data-color="#7c3aed"
data-logo="https://yoursite.com/logo.png"
data-launcher="💬"

WordPress: paste the snippet into a Custom HTML block or your theme footer. PHP/Laravel: put it in your layout template. React/Next.js: render it in your root layout or inject it in a useEffect.

Both endpoints are CORS-enabled and take your key in the X-Gatavase-Key header. The chatbot's personality lives on the server — it is never accepted from the client.

POST /api/public/chatbot/reply

curl -X POST https://gatavaseai.lovable.app/api/public/chatbot/reply \
  -H "Content-Type: application/json" \
  -H "X-Gatavase-Key: gvz_pk_xxxxxxxx" \
  -d '{
    "configId": "YOUR_CHATBOT_ID",
    "sessionId": "s_visitor_12345",
    "messages": [{ "role": "user", "content": "Do you deliver to Gulu?" }]
  }'

// 200 OK
{ "reply": "Yes — we deliver countrywide, usually 2-3 days to Gulu." }

GET /api/public/chatbot/config

curl "https://gatavaseai.lovable.app/api/public/chatbot/config?id=YOUR_CHATBOT_ID" \
  -H "X-Gatavase-Key: gvz_pk_xxxxxxxx"

// 200 OK — appearance only, never your system prompt
{ "welcome_message": "Hi 👋", "brand_color": "#7c3aed", "widget_title": "Chat with us",
  "widget_position": "bottom-right", "widget_size": "medium", "logo_url": null, "launcher_label": "💬" }

PHP example

<?php
$payload = json_encode([
  "configId"  => "YOUR_CHATBOT_ID",
  "sessionId" => session_id(),
  "messages"  => [["role" => "user", "content" => $_POST["message"]]],
]);
$ch = curl_init("https://gatavaseai.lovable.app/api/public/chatbot/reply");
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => ["Content-Type: application/json", "X-Gatavase-Key: gvz_pk_xxxxxxxx"],
  CURLOPT_POSTFIELDS => $payload,
]);
$reply = json_decode(curl_exec($ch), true)["reply"] ?? "";
curl_close($ch);
echo htmlspecialchars($reply);

• Per visitor IP: 20 messages / minute.
• Per embed key: 240 messages / hour — each key gets its own bucket, so one busy site never starves another.
• Per chatbot: 300 messages / hour.
• Per visitor session: 40 messages / hour.

Status codes: 401 missing or revoked key · 403 key not allowed on this origin · 404 chatbot id doesn't match the key, or bot paused · 422 message blocked as spam · 429 rate limited (see Retry-After) · 502 upstream AI error.

Every accepted and rejected request is written to your chatbot's access log with the origin, an irreversible IP fingerprint and the reason — so key abuse and id guessing are visible in the builder.

• Add your domains to Allowed origins on the key — requests from anywhere else get 403.
• Use a separate key per website or per customer, so you can revoke one without touching the others.
• Deactivate or delete a key instantly from the builder; the widget stops working within seconds.
• The widget is keyboard-navigable, screen-reader labelled and honours prefers-reduced-motion.

Available now: Chatbot reply and config endpoints, embed keys, transcripts and analytics export.
In preview: Text-to-Voice and document generation.
Coming next: Voice cloning, image generation, video generation, website-builder API and a TypeScript SDK.

Questions or early access: developer@gatavase.com.