Bolt an assistant onto your site.
Runs on your own API key. Answers only from content you gave it.
Install
Three screens, then one line of HTML.
01
Pick a model
Anthropic, OpenAI or Google, on your key.
02
Paste your content
Text, Q&A pairs, PDFs. No crawler.
03
Allowlist your domain
It refuses to load anywhere else.
Paste before </body>
Nothing of ours runs in your page.
- Your pageCSS untouched
- An iframesandboxed
- Your provideryour key, your invoice
What you get
Your key, your bill
We never resell tokens. It is encrypted at rest, and yes, we can decrypt it.
Hard daily caps
A message ceiling and a token ceiling, per agent. Then it stops.
Grounded or silent
It answers from your 150k characters, or it says it doesn’t know.
Branding tokens
Colour, radius, position, launcher, font. No CSS injection.
Every message logged
Token counts, block reasons, thumbs up or down.
We have no model
So there’s nothing here for your content to train.
Guardrails
Most abuse dies before a token is spent.
- The origin check is a gate, not a wall
- Your public key ships in your HTML, and an Origin header is forgeable by anything that is not a browser. Rate limits and daily caps are what protect your wallet.
- The model has no tools
- No function calls, no browsing, no database. A prompt injection has nothing to reach for.
Live demo
It is already on this page.
Look in the bottom corner. Same script tag, same guardrails, same everything.
Header copy, accent colour, starter questions, the source line under an answer. All of it is yours.
Three honest ones.
Can you read my API key?
Yes. It is encrypted with AES-256-GCM, but the decryption key lives on our server, so we hold both halves. That stops a database leak, a backup leak and a stray log line. It doesn’t stop us. Real zero-knowledge would need the key sitting in the visitor’s browser, and nobody is there to type a passphrase for a stranger on your homepage.
What does it cost?
Nothing, because there’s no way to pay us yet. Your provider bills you directly for tokens, at their rates. We never take a cut.
What happens when my key runs dry?
The widget stops answering and visitors see a neutral “unavailable right now”. They are never told which provider you use or that a card was declined. You see the real reason in your backoffice.