AI Gateway Playground

DEV

Connection

Provider Model Gateway key x-gateway-key Provider key Authorization: Bearer

Temperature

Max tokens

Stream responses (SSE)

System prompt On blocked message how a blocked turn affects the rest of the chat

Exclude (default) = the blocked message is dropped from the context sent next, so you can keep chatting. Keep = it stays in the history and every following turn re-sends and re-blocks it, so you must start a new chat.

Guard (injection / jailbreak)

Guard enabled

Fail mode guard down -> closed blocks, open allows

Enable model reasoning

Max tokens (guard) Tolerate these violations block -> pass if ALL match

Common: prompt_injection, jailbreak, malign_code, secret_exfiltration

PII / secrets

Redact in requests (input)

Redact in responses (output)

Allow mocks / placeholders

On = obvious test values pass through unredacted: RFC 2606 + acme.com emails (user@example.com), published test cards (4111 1111 1111 1111), sequential/repeated phones, zeroed tokens. Off (default) = treated as real PII and redacted.

Mock sensitivity reserved domains always count; this gates the email username heuristic

At ≥3, example@anycompany.com is a mock; at 5, also example.user@anycompany.com. Lower = fewer false-positive mocks (less PII leaked).

Obfuscated emails catches "n o m b r e @ ...", "nombre(at)host.com", "javier[a]host.com", "nombre at host dot com"

Brackets/spaced are always safe; the ambiguous "at"/"dot" words are gated. balanced relaxes them when the text mentions "email"/"correo"; aggressive is the widest.

Detect & redact none checked = all types

Block request if found (input)

Regex fallback list, used when the Presidio engine is off or unreachable.

Prompt cache

Enable prompt response cache (exact match)

On = a prompt byte-identical to a previous one (matched by a hash of the redacted text) returns the cached answer and skips the upstream model call. The guard and PII checks still run on every request - the cache never bypasses them. Off (default) = every request hits the model. The inspector shows x-cache: hit/miss.

Attachments

Analyze attached documents (PDF / TXT / DOCX)

Fetch remote file URLs (SSRF-guarded)

On = extract document text and analyze it like message input (PII + prompt injection). Adds latency; each file is SHA-256-keyed and its result cached. Off (default) = attachments are forwarded without analysis.

URLs

Analyze URLs in messages and documents (SSRF-guarded)

Excluded domains comma-separated; wildcards allowed Fail mode fetch/parse fails -> closed blocks, open skips

Max URLs per request

Fetch timeout (ms)

Max bytes per URL; 5242880 = 5 MB

On = fetch http(s) URLs found in the input (and inside analyzed documents) and analyze the page text like message input (PII + prompt injection). Excluded domains are trusted and skipped: example.com covers its subdomains, *.example.com matches subdomains only. Each URL is fetched once and cached. Off (default) = URLs are not fetched.

Presidio engine (primary)

Min score

Language

Default mode

Default format

Block above sensitivity level 0 = report only, 1-5 = reject at/above Per-entity policy

Mode: mask transforms, block rejects the request (403), observe only detects. Format (when mode=mask): replace -> [EMAIL_ADDRESS], mask -> ****1234, hash -> <HASH:..>. Sens. = risk weight 1-5 for the sensitivity score. Empty = use the defaults above.

Entity	Mode	Format	Sens.

Import / export config

Auto-saved in this browser (localStorage), including the gateway and provider API keys. Anyone with access to this browser or to an exported file can read them - only use it on a trusted machine.

auto-saves on change (live, in-memory); reverts on restart