---
name: Public AI support chat endpoint
description: Why /api/chat is unauthenticated and must stay rate-limited.
---

The support chat endpoint (`POST /api/chat`, SSE) is intentionally **public / unauthenticated** and uses the platform owner's own `OPENAI_API_KEY` (user opted out of Replit AI Integrations).

**Why:** The user wanted the chat widget on every page (including the logged-out welcome/login pages) and explicitly separate from account auth, and it must never read private user data — the system prompt has no DB access.

**How to apply:** Because it spends the owner's paid OpenAI credits with no login gate, it MUST keep server-side rate limiting (in-memory per-IP + global backstop in `routes/chat.ts`) and `trust proxy` enabled in `app.ts` so `req.ip` is the real client. Never remove the throttle or make it consume per-user account data. If abuse persists, escalate to CAPTCHA / anonymous session quota.
