Website widget

If you'd rather not call the API from your backend — paste a single <script>, and the file field will trigger moderation from the user's browser on its own.

1. Create a widget key and add domains

In the dashboard → Widget for your site → New widget key (pk_live_…). Add the domains where the widget should work — it will work only from those domains (we check the Origin header).

2. Paste the snippet

<script src="https://modwall.dev/widget.js" data-site-key="pk_live_..."></script>
<input type="file" data-modwall>

A data-modwall field automatically sends the selected file and emits an event with the result:

document.addEventListener("modwall:result", function (e) {
  console.log(e.detail);   // { scores, decision, threshold, _status }
  if (e.detail.decision === "block") {
    // np. zablokuj wysyłkę formularza
  }
});

JavaScript API

The global Modwall object:

const res = await Modwall.moderate(fileInput.files[0]);
// res = { scores: {nsfw, safe}, decision, threshold, _status }
if (res.decision !== "allow") {
  alert("Obraz nie przeszedł moderacji.");
}

Security

The pk_live_ key is public (visible in your page’s code). We protect it with a domain allowlist — a request from another domain gets 403. This is “browser-level” protection: it stops use from other people’s sites, but a determined attacker sending a request from outside the browser (e.g. curl with a spoofed Origin) will bypass it.

That's why you should enforce critical decisions server-side via the sk_live_ API. The widget is for UX (quick feedback on upload); the server API is the backbone of compliance.

Endpoint (under the hood)

Body multipart/form-data: site_key + image (optionally reference, image_url). Returns CORS headers for allowed domains. The response is the same as /v1/moderate.