SShortSingh.
Back to feed

Structuring an AI SaaS with FastAPI and Next.js: Key Architecture Decisions

0
·1 views

An AI SaaS differs from ordinary software because each request carries real cost, responses take seconds, provider dependencies are outside the team's control, and customers supply sensitive data. The guide recommends using Next.js for rendering and interface work while keeping business logic, data access and all model calls in a FastAPI backend, which also yields a typed API contract. A central rule is that browsers never contact LLM providers or hold provider keys, and authentication should use short-lived tokens with a rotating refresh token in an HttpOnly cookie. The article also advises choosing a tenancy model early, enforcing tenant isolation in a single data-access layer, and routing AI calls through an internal gateway that manages credentials, model allow-lists, retries, usage accounting and quotas. Long-running tasks such as document processing should be moved off the request cycle to avoid proxy timeouts.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Why Cash Conversion Cycle Matters Alongside Revenue Growth

The article argues that revenue shows a business is selling, but the cash conversion cycle reveals how quickly those sales become cash. The author examines inventory days, receivable days, and payable days together rather than relying on any single metric. Longer inventory holding and slower customer payments can tie up cash even while revenue and profit rise. The key question is whether a company can fund this working capital from its operations or whether growth keeps increasing its funding needs. The piece is general information only and not financial advice.

0
ProgrammingDEV Community ·

Building a Serverless PDF Summarizer with Claude, S3, and Lambda

The article explains how a PDF uploaded to an S3 bucket can be automatically summarized without managing any servers. It describes how AWS Lambda runs code only when triggered, scales automatically with concurrent uploads, and charges only for execution time. The workflow combines S3 for storage, Lambda for event-driven processing, and Amazon Bedrock for access to Claude's language model, with IAM roles granting the needed permissions. A minimal TypeScript Lambda handler is presented as a starting point, with the full summarization logic to be added in later steps.

0
ProgrammingDEV Community ·

cdk-nag v3 Moves Security Checks into CDK Policy Validation and Changes Exceptions

cdk-nag, the AWS CDK security checking library from cdklabs, was released as version 3.0.0 on June 12, 2026, with the current version at 3.0.2. The rewrite replaces its earlier Aspect-based rule packs with the CDK's built-in policy validation framework, so simply upgrading the version typically causes build errors. Exceptions now use Validations.of(construct).acknowledge() with a required reason instead of NagSuppressions, and wildcard findings must be acknowledged individually. The article demonstrates setup, exception handling, and Vitest-based testing with validateScope() using a fictional bike rental application, and explains how to write a custom rule pack.

0
ProgrammingDEV Community ·

GitLab fixes 500 errors from oversized comments across nine vulnerability GraphQL mutations

A GitLab merge request, gitlab-org/gitlab!269616, adds a length check to the comment argument of nine GraphQL mutations in its vulnerability management features. The bug stemmed from a 50,000-character limit that the model enforced but the API did not, so oversized input produced a generic internal server error. Bulk dismiss was worse, failing only at the database constraint because it skipped model validations. The change went through several rounds of CI fixes, including regenerating public GraphQL docs and introspection schemas, and was refined after reviewer feedback. The author's write-up highlights how easily such validation gaps ship unnoticed.