An API is a way one program asks another program for work or data. In this course, your server asks a model provider for a draft answer about fictional Cedar Academy courses.

First finish Secure APIs and Student Data and Testing, Deployment and Maintenance. You need an editor, Git and Node.js 22 or newer; Node 24 is the current long-term support release. You should know promises, HTTP, login checks, server environment variables and basic SQL. Required work uses offline samples. Optional live calls need your own key and may cost money.

Keep the jobs separate:

1. The browser collects a question.
2. Your server checks the signed-in user, course access and input.
3. Your server reserves the user's allowance, then calls the model.
4. Your server checks the reply before showing it.

Authentication checks who signed in. Authorization checks what they may access. The model does neither and may give a wrong answer.

A provider API key unlocks paid provider access. Store it only in a private server environment variable. A user login token identifies a user in your app. These are different credentials. Keep provider keys out of browser code, public variables, Git, screenshots and downloads.

The following is framework-neutral pseudocode. Each named function stands for your framework's real API.

POST /api/academy-help
  enforce same-origin / CSRF protections for cookie authentication
  session = verifyServerSession(request)
  if session is absent: return 401
  if session cannot access this course: return 403
  reject bodies larger than the configured byte limit
  question = parseAndValidate(request.body)
  if question is missing or longer than 1000 characters: return 400
  reserve quota for session.userId; if unavailable: return 429
  result = await modelAdapter(question, serverEnvironment)
  return validated public result; never return credentials

Look at the order. Authentication, course authorization, byte limits and the quota reservation all run before the billable model call. The browser can validate input too, for convenience, but anyone can bypass a browser form, so the server checks stay. Log a request ID, the duration and the outcome. By default, do not log keys or the student's question text. Show model output as plain text or safely rendered content, never as raw HTML.

1. Draw the request path: browser, application server, authentication service, model provider. Label which credential each arrow carries.
2. Turn the pseudocode into a checklist for the framework you use.
3. Use the five fictional request situations below to check your route. Fill in this table.

Your checklist is right when the order of checks produces exactly this table.

Your diagram labels all four parts. Your checklist separates authentication from course authorization, rejects oversized and requests with invalid format or fields, and reserves quota before generation. Your repository contains an example environment file with variable names only, and .gitignore excludes the real one.

Explain to a nontechnical reviewer, in three sentences, why an instruction inside a model's reply cannot give a student new permissions.

Next, you will make your first server-side model request, offline first.

OpenAI API authentication, Anthropic API overview and Vercel AI SDK introduction. Reviewed 2026-10-09.