Ai sdk Ai Questions

First treat the key as leaked: rotate it in the provider dashboard, because NEXT_PUBLIC_ values are inlined into the JavaScript bundle at build time. Then move the model call into a Route Handler, store the key in a variable without the NEXT_PUBLIC_ prefix, and import "server-only" in the module that uses it so a Client Component import fails the build. The browser only talks to your route, which adds auth and limits before calling the provider.

useChat keeps an array of UIMessage objects, each with an id, a role and a list of parts. sendMessage adds your message right away, sets status to submitted, posts the conversation through a transport and then applies each streamed chunk to the assistant message, moving status to streaming and finally to ready or error. Helpers like stop, regenerate and setMessages change that same array, and the throttle option limits how often React re-renders.

The server owns everything that must be trusted: the API key, the model choice, the system instructions, tool execution, auth, input validation, rate limits and saving the conversation. The client owns everything the user touches: the input box, the message list, rendering streamed parts, the stop button and loading or error states. In the App Router that usually means a Route Handler that returns a UI message stream and a Client Component that uses useChat.

An AI SDK gives you one API (generateText, streamText, tools, structured output and a UI message stream) on top of a shared language model specification, so switching providers is mostly a change to the model argument. What stays provider-specific is capability and behaviour: which models support tools, images or reasoning, how they tokenize and price, features like prompt caching, and extra settings you pass through providerOptions keyed by provider name.

Limit in layers, inside the Route Handler and before the model call. Identify the caller by user id (IP only as a fallback), apply a request limit such as a sliding window in Redis, and add a daily token budget per user because one request can cost far more than another. Cap input size and maxOutputTokens, return 429 with a Retry-After header when a limit is hit, and show a calm message in the UI.