Building With AI Models

| Parameter | Type | Required | Description | |---|---|---:|---| | OPENAI_API_KEY | string | Yes | Provider credential; never ship to browser code or mobile binaries | | INTERNAL_TOKEN | string | Yes | Application-to-server bearer token; store in a secret manager | | model | string | Yes | Provider model identifier, such as gpt-4.1-mini | | input | string | Yes | User content sent to the model | | Authorization | string | Yes | Header in the form Bearer | | timeout | number | No | Provider request timeout in seconds; default 30 | | max_output_tokens | integer | No | Upper bound on generated tokens; default provider behavior |

Code Example

`python

server.py import os from fastapi import FastAPI, Header, HTTPException from openai import OpenAI

Fail closed: the process must not start without required secrets. API_KEY = os.environ["OPENAI_API_KEY"] INTERNAL_TOKEN = os.environ["INTERNAL_TOKEN"]

client = OpenAI(api_key=API_KEY, timeout=30.0) app = FastAPI()

@app.post("/internal/models") def generate(input: str, model: str = "gpt-4.1-mini", max_output_tokens: int = 256, authorization: str | None = Header(default=None)): expected = f"Bearer {INTERNAL_TOKEN}" if authorization!= expected: raise HTTPException(status_code=401, detail="Unauthorized")

if not input.strip(): raise HTTPException(status_code=400, detail="input must not be empty")

response = client.responses.create( model=model, input=input, max_output_tokens=max_output_tokens, )

return { "id": response.id, "model": response.model, "output": response.output_text, } `

Set credentials outside source control:

bash export OPENAI_API_KEY="provider-secret" export INTERNAL_TOKEN="service-secret" uvicorn server:app --host 127.0.0.1 --port 8000

Response Format

json { "id": "resp_abc123", "model": "gpt-4.1-mini", "output": "Generated text returned by the provider." }

id identifies the provider response, model records the resolved model, and output contains generated text. Authentication failures return 401; invalid input returns 400; provider failures should be mapped to controlled 5xx responses without exposing the provider key.

Notes & Best Practices

• Apply the Credential Boundary Method: clients authenticate to your server; only the server authenticates to the model provider. - Use a secret manager in production, rotate keys periodically, and grant each environment a separate credential. - Redact Authorization, environment values, request headers, and provider SDK exceptions from logs and traces. - Enforce request timeouts, rate limits, and bounded max_output_tokens; return retryable errors only when the provider indicates transient failure.

This boundary establishes the security contract required by later model, retrieval, and agent components.

End of chapter one. 39 more chapters and about 21,098 words in the full book.