IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Using AI through an API
Priya's team wants AI to sum up each new support ticket, with no person typing. Your goal: read and build an AI request.
🧪 Interactive lab — enable JavaScript to play with this one.
- Many AI APIs remember nothing. Send the whole chat every time.
- You pay for every token, in and out.
- Check why the answer stopped. It may be cut off.
- Your key pays the bill. Keep it on a server.
Chat app vs API
An API is a door that lets one program ask another for something. It is like a waiter who takes your order to the kitchen. An AI API is that door to a model. Your code sends a request and gets JSON back.
A chat app keeps your chat for you. Many AI APIs do not. Each call stands alone, so it is a stateless API. Each request carries the whole chat so far. You pay for every token, in and out.
The parts of a request
| Part | What it does |
|---|---|
model | Picks which model answers. |
max_tokens | The most the model may write. |
system | Standing rules for the whole chat. |
messages | The chat as a list of turns. Each turn has a role, user or assistant. |
Read the response
The answer is in content. The token counts you pay for are in usage.
Also check the stop reason. end_turn means the answer is whole, even if long. max_tokens means it was cut off at the limit. Don't post half an answer. Flag it, or raise the limit.
Now build the message list yourself.
🧪 Interactive lab — enable JavaScript to play with this one.
Go deeper: keep your key safe
You met the API key in Tech basics. You make it in the provider's console. It proves which account is calling, and that account pays. Anyone who has your key can spend your money. They may also see what your app sends.
- Keep it on your server. This is a computer you control that runs your app. Anyone can read a web page or a phone app. A key there is public.
- Store it in an environment variable or a secrets manager. Both keep it outside your code. Never put it in your code or in a repository. A repository is the shared folder where code is stored.
- Give each app its own key. Then you can turn off one key without breaking the rest.
- If a key leaks, replace it at once.
Everything in messages goes to the provider. So check what data you send. See Safe AI at work.
For how keys differ from short-lived tokens, see API keys vs tokens.
Go deeper: streaming
Normally, the whole answer comes at the end, in one piece. With streaming on, the server sends small pieces while the model writes. It uses a simple web standard called server-sent events. That is why answers seem to type themselves.
The wait until the first words appear is the time to first token. Streaming does not change the total time or the cost. But people can start reading sooner. They can also stop a bad answer early. And long answers are less likely to time out. For a job that runs at night, skip it. Just take the finished answer.
Go deeper: other providers and tools
Other providers use the same parts with different names. Examples are OpenAI and Google's Gemini API. Many tools for open models copy OpenAI's request format. Examples are Ollama, vLLM, LM Studio and llama.cpp. So the same code can often use a model on your own laptop. You just change the address.
Some providers can also keep the chat on their side. Then you send an id instead of the whole chat. Check what your provider offers.
You rarely write the raw request by hand. Providers offer ready-made code libraries, called an SDK. Some tools put one door in front of many providers. Examples are LiteLLM, the Vercel AI SDK and OpenRouter. Inside, the request and the response are the same as in the figure.
Go deeper: when a request fails
Every reply carries a number, the status code. 200 means OK. Errors are normal, so your code should expect them.
401: the key is wrong or missing.400: the request is badly formed.429: too many requests. See Cost, limits and caching.5xxor "overloaded": a short problem at the provider. Wait a little, then try again.
The model may also ask to use a tool instead of answering. Your code must handle that. See Tool calling and structured output.
Never put an API key in a web page, a shared notebook or a screenshot. Bots hunt for keys.
Open a playground, like Google AI Studio or the Claude Console. Click Get code to see the real request. Use test text only. Free tiers may train on it.