Integrating OpenAI Without Shipping a Science Project
I have seen teams burn two sprints wiring ChatGPT into a Laravel app, only to discover their API key sitting in frontend JavaScript on day one of security review. OpenAI integration is straightforward when you treat it like any external API: server-side calls, strict rate limits, structured logging, and cost caps from day one.
Architecture Basics
Never call OpenAI from the browser unless you are using ephemeral tokens with a backend broker. Your PHP or Node service should own the API key, validate user input, and return sanitized responses. Store conversation IDs server-side if you need multi-turn context—do not pass full chat history from the client unchecked.
// Laravel controller sketch
public function complete(Request $request, OpenAiClient $ai)
{
$validated = $request->validate([
'prompt' => 'required|string|max:2000',
]);
$response = $ai->chat()->create([
'model' => 'gpt-4o-mini',
'messages' => [
['role' => 'system', 'content' => 'You are a concise support assistant.'],
['role' => 'user', 'content' => $validated['prompt']],
],
'max_tokens' => 512,
]);
return response()->json([
'text' => $response->choices[0]->message->content,
]);
}Cost and Reliability Controls
Set per-user and global rate limits in Redis. Log token usage per request—OpenAI returns usage.prompt_tokens and usage.completion_tokens in every response. Alert when daily spend crosses 80% of budget. Use streaming for UX, but still accumulate tokens server-side for billing reconciliation.
For production, wrap calls in retries with exponential backoff on 429 and 5xx errors. Cache deterministic completions (e.g., product summaries) with a TTL. One e-commerce client cut API spend by 22% caching category blurbs for 24 hours.
Security Checklist
- API keys in environment variables or secrets manager—never in git.
- Input sanitization and output filtering for PII leakage.
- Separate keys per environment (dev/staging/prod).
- Audit log of prompts for compliance-heavy industries.
Streaming and User Experience
Streaming completions improve perceived latency even when total token time is identical. Pipe Server-Sent Events from your backend to the frontend and render tokens incrementally. Cap stream duration at 30 seconds with a graceful timeout message—runaway generations cost money and annoy users waiting on blank screens.
Build an evaluation set of 50–100 representative prompts before launch. Score outputs for accuracy, tone, and refusal behavior on sensitive topics. Re-run evals when you change models or system prompts. Teams that skip this step discover regressions from customer screenshots, not dashboards.
For multi-tenant SaaS, attribute token usage per account_id in your logging pipeline. Pass through overage billing or throttle heavy users fairly. One API misuse incident—a recursive agent loop—can burn hundreds of dollars in minutes without per-tenant caps.
Document model fallback chains: if gpt-4o hits rate limits, degrade to gpt-4o-mini on non-critical paths with logging. Circuit breakers prevent cascade failures during OpenAI regional outages—queue requests and surface a maintenance message instead of 500 errors triggering client retry storms. Keep a monthly spend dashboard visible to engineering leads, not buried in finance reports reviewed quarterly.
Production Checklist Before Launch
Load test with concurrent users simulating peak support hours—OpenAI rate limits are per organization and model. Implement request queuing with max wait time displayed to users. Add content moderation layer for user-generated prompts in consumer-facing features; OpenAI moderation endpoint is cheap insurance against brand damage from toxic outputs displayed verbatim.
Store prompts and completions encrypted at rest if they contain PII. Define retention policy—90 days default with automated purge unless case flagged for legal hold. GDPR data subject access requests must include LLM interaction history if you log it.
Consider Azure OpenAI or AWS Bedrock when enterprise contracts require data processing in specific regions. Same integration patterns apply with endpoint changes. Measure latency from chosen region to users—serving US customers from ap-southeast adds perceptible delay on streamed completions that aggregate over long responses.
Frequently Asked Questions
Which OpenAI model should I start with?
gpt-4o-mini handles most business chat and classification tasks at roughly 10x lower cost than flagship models. Upgrade selectively where quality gaps show up in evals.
How do I prevent prompt injection?
Separate system instructions from user content, strip HTML, and never let the model execute code or fetch URLs without a sandbox. Treat user input as hostile.
Should I use the Assistants API or Chat Completions?
Chat Completions plus your own retrieval layer gives more control and is easier to test. Assistants API helps for rapid prototypes with built-in file search if you accept vendor lock-in.