Get In Touch
0% complete

Generative AI and LLM applications with Python · Lesson 1 of 3

Python clients for generative AI models

Call a language-model API with structured inputs, safe secrets, and bounded requests.

Lesson

1. Concept and mental model

Python applications can call hosted or locally served language models through provider SDKs or HTTP APIs. Keep the model call behind a small client boundary that accepts an explicit prompt and returns a well-defined result. Load credentials from a secret manager or protected configuration, never from committed source code. Send credentials only to the provider’s documented host, set request timeouts, and avoid placing private user data in prompts unless the system is approved to process it.

2. How it works

A model response is untrusted input, even when it is valid JSON. Validate the expected shape, types, allowed values, and maximum length before using the result in business logic. Requesting structured output can reduce parsing ambiguity, but it does not guarantee factual correctness or enforce authorization. Never let text generated by a model bypass permission checks or directly trigger a dangerous operation.

3. Use it safely and effectively

Handle rate limits and transient errors with bounded retries and exponential backoff where appropriate. Log model name, duration, and safe request identifiers, not secrets or full sensitive prompts. Track cost and latency and provide a fallback or clear user-facing failure. Practice by building a small summarization client that validates a response and rejects an unexpected field type.

4. Syntax reference

import os

api_key = os.environ['MODEL_API_KEY']
# Pass api_key through the provider SDK's secure credential parameter.
# Validate the returned object before using generated text.

5. Guided walkthrough

Load the credential from protected runtime configuration, send only the minimum necessary input with a timeout, and validate the returned structure before using generated text. Keep the provider-specific request behind a small client so retries, errors, and privacy rules stay consistent.

6. Common mistakes to avoid

  • Committing a model API key or writing it to application logs.
  • Trusting generated JSON as correct or authorized without schema and business-rule validation.

Visual guide

Safe model request

  1. Step 01 Prepare

    Minimize sensitive input and load secrets safely.

  2. Step 02 Call

    Send a bounded request to the approved provider.

  3. Step 03 Validate

    Check generated output before application use.

Code examples

Worked example
PYTHON 
import os

api_key = os.environ['MODEL_API_KEY']
# Pass api_key through the provider SDK's secure credential parameter.
# Validate the returned object before using generated text.
Expected output
The credential is read at runtime and is not embedded in source code.
Validate structured model output
PYTHON 
response = {'summary': 'Three useful points'}
summary = response.get('summary')
if not isinstance(summary, str) or len(summary) > 500:
    raise ValueError('Invalid summary')
print(summary)
Expected output
Three useful points
Read a secret without logging it
PYTHON 
import os

api_key = os.environ.get('MODEL_API_KEY')
if not api_key:
    raise RuntimeError('MODEL_API_KEY is required')
print('Credential configured:', bool(api_key))
Expected output
Credential configured: True

Key points

  • Call a language-model API with structured inputs, safe secrets, and bounded requests.
  • Prefer explicit, testable behavior over hidden side effects.
  • Validate assumptions at system boundaries and handle failure deliberately.

Check your understanding

Practice

Should a valid JSON model response be trusted without validation?

Your learning progress

Finish this lesson