Safe API calls lab

A lab for calling hosted model APIs without leaking secrets, logging PII, or ignoring rate limits and costs.

Most builders’ first production incident is a leaked key or an unbounded prompt loop—not a fancy algorithm bug.

1. Put keys in environment variables
2. Use official SDKs
3. Set timeouts and max tokens
4. Log metadata, not raw sensitive prompts, when possible
5. Add retries with backoff—carefully

Like using a debit card online: don’t screenshot the full number into a group chat.

Call a cheap model with “ping” and print only status + token usage—not the key.

⚠️ Myth: Hard-coding a key “just for today” is fine.

✓ Reality: Keys migrate into git history and screenshots.

⚠️ Myth: Client-side web apps can hide keys.

✓ Reality: Anything in the browser can be extracted—use a backend.

• Course 19 security-basics; Course 21 setup
• Provider quickstarts (cite the API you use)
• OWASP secrets themes: https://owasp.org/www-project-top-10-for-large-language-model-applications/ ↗