Mock chat

A working server-side endpoint with a mock behind it. It holds an API key the browser never receives, refuses more than twelve messages a minute, and can be switched off without affecting any other page.

Nothing here is a language model. Replies come from a fixed list, chosen by a hash of what you have typed. The same conversation always produces the same reply. No model is called and nothing is spent.

What this demonstrates

• A secret held server-side. The endpoint reads an API key from the Worker's environment. It is not in the page, not in any script the browser downloads, and not in version control.
• Configuration that checks itself. Remove the key and the endpoint returns a 500 that names the missing variable, rather than failing somewhere further in with a less useful message.
• Rate limiting. Twelve messages a minute per address, then a 429 with a Retry-After header.
• A switch. One variable disables this endpoint. Every other page keeps serving, because every other page is a static file that never reaches the Worker.
• A seam. Substituting a real provider is one new file and one changed variable.