█
LastWrite
  • > Curriculum
  • > Pricing
  • > For Educators
  • > About
  • > Contact
Log InGet Started

Questions, concerns, bug reports, or suggestions? We read every message, write to us at [email protected].

More ways to reach us →
LastWrite

Structured computer science lessons for aspiring developers and security professionals.

[email protected]

(201) 785-7951

Mon–Fri, 9 AM–5 PM EST

Learn

  • Curriculum
  • Pricing

Company

  • About
  • For Educators & Schools
  • Contact Us

Legal

  • Terms of Service
  • Privacy Policy
© 2026 LastWrite. All rights reserved.
Curriculum/Web Development/AI Application: Web Development/Building AI-Powered Features into Web Apps
60 minIntermediate

Building AI-Powered Features into Web Apps

After this lesson, you will be able to: Add a real AI feature to one of your apps by calling the Anthropic or OpenAI API from a backend route, safely, and with a good UX.

Now that you've used AI tools, you can build with them, adding AI features to apps you ship. This lesson walks through calling the Anthropic API from your Express backend, streaming responses, handling errors, and the security mistakes to avoid.

Prerequisites:AI in Web Development: The New WorkflowIntroduction to Backend Concepts

Why API keys must live on the backend

If you call the Anthropic or OpenAI API from frontend JavaScript, anyone who opens DevTools sees your key, and can spend your money. All AI API calls must go through your backend. Your frontend talks to your backend, your backend talks to the API.

Browser
POST /api/ask⇄
Express server
holds the API key
authenticated request⇄
Anthropic API
The API key never touches the browser. The server is the only thing that talks to Anthropic, and the reply flows back through the same chain.

A minimal Anthropic API call from Express

Install: npm install @anthropic-ai/sdk. Set ANTHROPIC_API_KEY in your environment.

tsx
// server.js
const express = require("express");
const Anthropic = require("@anthropic-ai/sdk").default;
const app = express();
app.use(express.json());
const anthropic = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
app.post("/api/ask", async (req, res) => {
const { question } = req.body;
if (!question || question.length > 2000) {
return res.status(400).json({ error: "invalid question" });
}
const response = await anthropic.messages.create({
model: "claude-sonnet-4-6",
max_tokens: 1024,
messages: [{ role: "user", content: question }],
});
res.json({ answer: response.content[0].text });
});
app.listen(3000);

Calling it from the frontend

Standard fetch, the secret stays on the server.

tsx
// In your frontend script.js
async function ask(question) {
const res = await fetch("/api/ask", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ question }),
});
const data = await res.json();
document.querySelector("#answer").textContent = data.answer;
}

⚠️ Warning, rate limit, validate, and budget

Real AI features can cost real money. Always: (1) validate user input length on the backend, (2) rate-limit per user (e.g., 10 requests/minute), (3) set a hard monthly spend cap on your Anthropic/OpenAI dashboard, and (4) never let users put arbitrary text into your system prompt without sanitization.

Picking a model and a price point

Pick the smallest model that does the job. For a chatbot or content generator, Claude Haiku or GPT-4o-mini is fast and cheap. For coding help or complex reasoning, Claude Sonnet or GPT-4o. Save the biggest models (Opus, GPT-4) for the moments where the answer quality really matters.

Try it: a Q&A widget

Build a tiny app that lets users ask AI a question and shows the answer.

  1. 1

    In the in-browser editor, create a Node.js project with Express

  2. 2

    Add ANTHROPIC_API_KEY to the in-browser editor Secrets

  3. 3

    Write the POST /api/ask route from above

  4. 4

    Build a tiny HTML page with an input, a button, and a result div

  5. 5

    Wire the frontend to call /api/ask and render the answer

  6. 6

    Deploy the project and share the URL

Quick Check

What happens if you call anthropic.messages.create() from frontend JavaScript with your API key?

Hint: think about who can see your network requests.

Sign in and purchase access to unlock this lesson.

Sign in to purchase
←AI-Assisted Debugging, Testing, and Deployment
Back to AI Application: Web Development
Prompt Engineering for Developers→