Api on David Lang

FastAPI + LangChain: Building Production-Ready AI APIs

Fri, 05 Sep 2025 00:00:00 +0000

FastAPI’s async support and automatic OpenAPI docs pair naturally with LangChain for production AI backends.

Project Structure

app/
  main.py
  routers/chat.py
  services/rag.py
  models/schemas.py

Async Endpoint

from fastapi import FastAPI
from pydantic import BaseModel

app = FastAPI()

class ChatRequest(BaseModel):
    message: str

@app.post("/chat")
async def chat(req: ChatRequest):
    result = await rag_chain.ainvoke({"input": req.message})
    return {"answer": result["answer"]}

Production Checklist

Rate limiting, API keys, structured logging, health checks, timeout on LLM calls, background tasks for long ingest jobs.

Claude API vs OpenAI API: Choosing the Right LLM

Wed, 14 Aug 2024 00:00:00 +0000

Anthropic’s Claude and OpenAI’s GPT families both offer strong APIs. Choosing between them depends on task, context length, cost, and compliance-not benchmark hype alone.

Strengths at a Glance

Claude - Long context windows, careful refusals, strong long-document analysis and coding reviews.

OpenAI - Broad ecosystem, function calling maturity, image and audio modalities, largest third-party integration surface.

Integration Pattern

Abstract the provider behind an interface:

interface LLMProvider {
  chat(messages: Message[]): Promise<string>;
}

Swap implementations per route (cheap model for classification, premium for generation).

JWT Authentication: Securing Your REST API

Sat, 05 Sep 2020 00:00:00 +0000

JSON Web Tokens (JWT) are a compact way to represent claims between parties. For stateless REST APIs and SPAs, JWT-based auth is a standard pattern-when implemented correctly.

Token Structure

A JWT has three Base64-encoded parts: header, payload, and signature. The server signs the token with a secret (HS256) or private key (RS256). Clients send Authorization: Bearer <token> on each request.

Issuing Tokens in Node.js

const jwt = require('jsonwebtoken');

function login(req, res) {
  const user = validateCredentials(req.body);
  if (!user) return res.status(401).json({ error: 'Invalid credentials' });

  const token = jwt.sign(
    { sub: user.id, role: user.role },
    process.env.JWT_SECRET,
    { expiresIn: '1h' }
  );
  res.json({ token });
}

Middleware Verification

function authMiddleware(req, res, next) {
  const header = req.headers.authorization;
  if (!header?.startsWith('Bearer ')) return res.sendStatus(401);
  try {
    req.user = jwt.verify(header.slice(7), process.env.JWT_SECRET);
    next();
  } catch {
    res.sendStatus(401);
  }
}

Security Checklist

Keep secrets out of source control. Use short expiration and refresh tokens for long sessions. Never store sensitive data in the payload-it is readable. Prefer HTTPS everywhere.

Introduction to GraphQL: Why It Matters

Sat, 25 Jul 2020 00:00:00 +0000

GraphQL is a query language for APIs that lets clients request exactly the fields they need. Unlike REST, you avoid over-fetching and under-fetching by design.

Schema-First Design

type Query {
  user(id: ID!): User
  posts(limit: Int = 10): [Post!]!
}

type User {
  id: ID!
  name: String!
  posts: [Post!]!
}

Clients send queries that mirror the shape of the response:

query {
  user(id: "1") {
    name
    posts(limit: 5) { title createdAt }
  }
}

Server Implementation

Apollo Server and GraphQL Yoga are popular in Node.js. Resolvers map fields to databases or microservices. Use DataLoader to batch N+1 queries.