Page-lock — watermark

A v-key is only useful inside your page. If someone copies the sk-… from devtools and tries to use it for coding, math or generic chat, the request is rejected.

How it works

Every request through the proxy is inspected before it reaches the model. The proxy requires a page-specific watermark in the system prompt — the Klunq Widget sends it automatically. Requests that do not carry the watermark, or that try to move the system prompt, are blocked.

• Runs on every request, no client opt-in.
• Only the widget’s page-bound prompt satisfies the check.

Rules

1. messages must be non-empty
2. At most one system message
3. The system message must be messages[0]
4. It must contain the required watermark (handled by the widget)

What the client sees

The proxy rejects them with HTTP 400 Bad Request containing a Guardrail Violation message.

The widget is built to send a watermarked system prompt that satisfies this. Direct curl without it is blocked:

# Blocked — system not first
curl -i -X POST "$PROXY_URL/v1/chat/completions" \
  -H "Authorization: Bearer $VKEY" \
  -d '{"model":"gemma4","messages":[
        {"role":"user","content":"hi"},
        {"role":"system","content":"… watermark"}]}'
# → HTTP/1.1 400 Bad Request
#   Guardrail Violation: system message, when present, must be the first element in messages

# Blocked — missing watermark
curl -i -X POST "$PROXY_URL/v1/chat/completions" \
  -H "Authorization: Bearer $VKEY" \
  -d '{"model":"gemma4","messages":[
        {"role":"system","content":"You are helpful."},
        {"role":"user","content":"hi"}]}'
# → HTTP/1.1 400 Bad Request
#   Guardrail Violation: messages[0] content must contain the required watermark

# Allowed (widget does this for you)
curl -X POST "$PROXY_URL/v1/chat/completions" \
  -H "Authorization: Bearer $VKEY" \
  -d '{"model":"gemma4","messages":[
        {"role":"system","content":"You are the page agent for https://example.com. watermark"},
        {"role":"user","content":"Summarize this page."}]}'
# → HTTP/1.1 200 OK  finish_reason:"stop"

Why this helps business

• Leak tolerance: Even if a v-key is scraped, it cannot be automated against another prompt style.
• Predictable scope: Klunq Widget page agentsends a page-specific prompt - usage stays tied to that surface -the website.

Next: Curated models · Deployment strategies