Nextjs Interview Questions

First treat the key as leaked: rotate it in the provider dashboard, because NEXT_PUBLIC_ values are inlined into the JavaScript bundle at build time. Then move the model call into a Route Handler, store the key in a variable without the NEXT_PUBLIC_ prefix, and import "server-only" in the module that uses it so a Client Component import fails the build. The browser only talks to your route, which adds auth and limits before calling the provider.

The server owns everything that must be trusted: the API key, the model choice, the system instructions, tool execution, auth, input validation, rate limits and saving the conversation. The client owns everything the user touches: the input box, the message list, rendering streamed parts, the stop button and loading or error states. In the App Router that usually means a Route Handler that returns a UI message stream and a Client Component that uses useChat.

Limit in layers, inside the Route Handler and before the model call. Identify the caller by user id (IP only as a fallback), apply a request limit such as a sliding window in Redis, and add a daily token budget per user because one request can cost far more than another. Cap input size and maxOutputTokens, return 429 with a Retry-After header when a limit is hit, and show a calm message in the UI.

Start the upstream request, then hand its body stream straight to your response instead of awaiting text() or json(). In a Next.js Route Handler that means returning new Response(upstream.body); in Express, pipe Readable.fromWeb(upstream.body) into res. Then remove hidden buffers along the path (compression middleware, nginx proxy buffering, caches) and abort the upstream call when the client disconnects.