Connecting to an AI Service Safely

Step 1: How an app asks a model

An AI service lives on someone else’s computer. Your app sends it a request over the internet and gets a response back. The request usually includes:

1. Who you are: your API key.
2. What you want: the prompt, plus settings such as how long the answer may be.

The response is usually JSON, text that looks like a Python dictionary. Your code reads the part it needs.

response = {"text": "A volcano is an opening in the Earth where hot rock escapes."}
print(response["text"])

A volcano is an opening in the Earth where hot rock escapes.

Step 2: Keys are secrets

An API key works like a password with a bank card attached: whoever has it can make requests that may cost money or use your quota. So:

• Never type a key into your code, a document, a chat or a screenshot.
• Never upload code that contains a key to a public place.
• Keep it in an environment variable or the secrets setting of your tool, and read it from there.

import os

api_key = os.environ.get("AI_API_KEY")   # reads a secret setting

if api_key is None:
    print("No key found, so the app will use the offline fake model.")
else:
    print("A key is set. The app can use a real service.")

No key found, so the app will use the offline fake model.

If a key leaks: log in to the service and revoke it right away. Then create a new one. Deleting the post is not enough, because someone may already have copied it.

Step 3: When things go wrong

Networks fail. Services get busy. A good app expects that. Python’s try and except let you handle an error instead of crashing.

def ask_service(prompt):
    raise RuntimeError("service is down")

try:
    answer = ask_service("Hello")
    print(answer)
except RuntimeError:
    print("Sorry, the helper is resting. Please try again soon.")
finally:
    print("Done.")

Sorry, the helper is resting. Please try again soon.
Done.

When you call a real service, set a timeout so the app doesn’t wait forever, and handle the error in the except block with a friendly message.

Step 4: The real call (for reference)

Each provider has its own address and field names, so you must follow your provider’s documentation. The general shape looks like this. This code needs a real service and key, so don’t run it in class unless your teacher says so.

import os
import requests

API_URL = os.environ.get("AI_API_URL")
API_KEY = os.environ.get("AI_API_KEY")

def ask_real_model(prompt):
    reply = requests.post(
        API_URL,
        headers={"Authorization": f"Bearer {API_KEY}"},
        json={"prompt": prompt},          # field names vary by provider
        timeout=20,
    )
    reply.raise_for_status()               # raises an error if the service says no
    return reply.json()["text"]            # where the answer lives varies too

Services also have rate limits (a cap on requests) and prices. For a classroom app, that means: ask only when needed, keep prompts short, and never let a loop send requests forever.

Step 5: One door for every model

Remember Session 1: our app calls a single function. Here is the plan that keeps your app flexible and safe.

USE_FAKE = True   # True while practicing. Switch only when your teacher says so.

def fake_model(prompt):
    return "(practice answer) Here is a simple explanation for: " + prompt

def ask_ai(prompt):
    try:
        if USE_FAKE:
            return fake_model(prompt)
        return "A real model would answer here."   # call ask_real_model(prompt)
    except Exception:
        return "Sorry, I couldn't get an answer. Please try again."

def explain_word(word, age):
    prompt = f"You are a kind teacher. Explain the word '{word}' to a {age}-year-old in 2 sentences."
    return ask_ai(prompt)

print(explain_word("gravity", 9))
print("AI-generated. Check important facts.")

(practice answer) Here is a simple explanation for: You are a kind teacher. Explain the word 'gravity' to a 9-year-old in 2 sentences.
AI-generated. Check important facts.

Everything outside ask_ai stays the same whether the answer comes from a fake or a real model. Even with a real one, you must still validate the input and label the output, which is what we do next session.