Advanced · Building with AI · module 144 of 155
Working with an AI API: keys, limits and costs
Call an AI model from your own application, with secure keys, limits on usage and visibility of the costs.
After this lesson
You store API keys securely, set limits on usage and costs, and handle errors and data carefully.
In view · Step by step
Using an AI API safely and affordably
On the server, a separate key for each application, and revoked at once if it leaks.
A budget with a warning, a limit per user and a maximum length.
Limited retries, a fixed model version and only the data that is needed.
Part 1 of 3 · Key as a secret
Your preference for less movement is on. Choose each part yourself.
A key is like a bank card
Anyone who calls an AI model from their own application uses an API: a technical entry point with a key. Every call with that key costs money. So store the key as a secret on the server, never in the code of a web page, an app or a shared document (lesson 143). Give each application its own key with only the necessary permissions, and replace a key immediately if it may have leaked.
Limits on usage and costs
Set a monthly budget or an alert with the provider, if possible. In your application, limit how many questions a user may ask per day and how long input and answers may be (lessons 31 and 80). Longer input and a larger model cost more per question. Calculate in advance: number of users times questions per day times cost per question. Then measure actual usage and compare it with your estimate.
Handling errors and data carefully
An API may temporarily fail to respond or report a limit. Then try again a limited number of times, with a longer pause each time, and show the user a clear message (lesson 91). Record which model version you use, so that the behaviour does not change unnoticed (lesson 128). Read the provider’s terms: what happens to the data you send, and how long is it kept? Only send what is necessary, and do not log complete conversations containing personal data.
New practice example
From explanation to a usable result.
An API key is a secret that costs money. Keep it on the server, set limits and calculate the costs in advance.
Fictional practice situationFictional: an association builds an assistant that summarises newsletters. The developer puts the API key in the website’s JavaScript, so that the assistant works directly from the browser.
View a possible solution
This is how it can be done
The key must be removed from the browser code: anyone can read it there and use it at the association’s expense. The browser sends the question to the association’s own server, which keeps the key as a secret, applies a limit per visitor and calls the model. The old key is revoked.
Why this works
Only a server can keep a key secret and enforce limits. A key that was already visible should be treated as leaked.
Make it slightly more difficult
Which three figures do you want to see each day to keep track of your application’s costs, without storing personal data?
Extra practice, at your own pace. You do not need to submit anything. This does not count towards an automatic assessment.
Your workplace · learning by doing
Make something. See what changes.
Checking the AI connection… You can already view the written example.
Present your assignment to Ende.
Read the answer, change one thing, and compare.
Previously held
New version
You remain in control
What do you want to improve in your next attempt?
On this device only. AI answers remain only in this page memory. This is self-review, not a grade.
Why this approach works
Only a server can keep a key secret and enforce limits. A key that was already visible should be treated as leaked.
A step further
Which three figures do you want to see each day to keep track of your application’s costs, without storing personal data?
Try & discover · no obligation
Calculate tokens and fictional costs per question
Make the input longer and reserve more space for the answer. How do the fictional costs per question change?
Blue: inputGreen: answer spaceGrey: free space
The specified input and reserved output fit together in this window.
Practice model, not a real tokenizer or product limit. Input also includes instructions and history. Fictitious rate: € 0,002 per 1.000 input tokens and € 0,006 per 1.000 output tokens. Actual rates and calculation rules differ.
This trial works locally with fictitious data and does not count towards your lesson completion. It starts anew with a new lesson or reload.
A prompt to get you started
Help me estimate the costs for a fictional application that uses AI to answer members’ questions. Assumptions: 200 members, an average of 2 questions per member per week, about 1,500 tokens of input and 400 tokens of output per question. Use fictional rates per million tokens that I will fill in myself: [input rate] and [output rate]. Show the calculation per month and suggest two limits that keep the costs down.
Apply it
A small web app uses an AI API. After a month the bill turns out to be ten times higher than expected: one user had a script ask thousands of questions a day.
Which approach best fits this situation?
- Set a limit per user and a monthly budget with an alert, and check whether the key is still secure.
- Pay the bill and hope it doesn’t happen again.
- Switch to a larger model so the answers are better.
With JavaScript, you can check your approach and receive immediate feedback.
Test your insight
You discover that your API key was in a public code repository. What do you do first?
- Remove the code from the repository, and that solves it.
- Revoke the key immediately and create a new one, and then check the usage and costs.
- Wait and see whether unusual usage shows up.
Extra practice
For an application you know or make up, make a cost estimate per month, and note three limits: a monthly budget, a limit per user and a maximum length for input and answer.
Usage: 200 members × 2 questions × about 4.3 weeks = about 1,720 questions per month. Tokens: 1,720 × 1,500 = 2.58 million input tokens and 1,720 × 400 = 0.69 million output tokens. With my fictional rates, that costs a few euros per month. Limits: a monthly budget with an alert at 80%, a maximum of 10 questions per member per day and answers of at most 400 tokens. The key is stored as a secret on the server.
