Converge
Open the app

Week 8 · Season 2 · Face and hands

Hands, and out into the world

You can give FRIDAY tools it can't misuse, connect it to real services, protect it with sign-in, and put it online so it answers from your phone.

Open week 8 in the app

This week

  • Tool calling: the model asks, your code acts
  • Good tool design: tools it can't misuse
  • Calling APIs: query parameters, timeouts, 429s and caching
  • Sign-in, passwords, sessions, API keys and secrets
  • Hosting, environment variables, domains and HTTPS
  • Go deeper: OAuth with PKCE, CDNs and the edge

How you learn

Write the tool loop yourself: read the model's tool request, check it against your allow-list, run it, send the result back. Hash passwords with a proper library, never by hand.

What you build

Project 1 and the boss: FRIDAY goes online. Deployed over HTTPS and reachable from your phone, with sign-in, its database and at least two tools, one of them a real outside API. Secrets live in environment variables.

Stretch: Add "Sign in with GitHub" (OAuth), and serve the page from a CDN.

What you ship

Project 1: FRIDAY goes online. A chat page, your own server and database, real tools and sign-in, reachable from your phone.

  • PLAN.md Part 6 with a card for each tool, and a drawing of the round trip from your phone
  • A live HTTPS address for FRIDAY, with sign-in
  • Two tools with tests, one calling a real outside API
  • No secrets in the repo: they live in environment variables

Lessons

  1. Give it hands

    After this deck you can explain a tool call (the model asks, your code runs the tool and sends the result back), read one in JSON, and write the tool loop that keeps going until the model answers.

    11 minFull access

  2. Tools it can't misuse

    After this deck you can find the tool behind an AI mistake from its log, and redesign it: small tools with clear descriptions, inputs checked in your code, a yes from a human before anything risky, and mistakes that can be undone.

    11 minFull access

  3. Talking to the real world

    After this deck you can read and build an API address with query parameters, call another service from Python with a timeout, check the reply's shape, and keep answers in a short-lived cache.

    11 minFull access

  4. Who's knocking?

    After this deck you can explain authentication, store passwords as salted, slow hashes, keep people signed in with a session, give programs API keys, keep secrets out of code, and defend a sign-in door against a scripted attacker.

    12 minFull access

  5. Into the cloud

    After this deck you can explain hosting, move FRIDAY onto a host with its settings in environment variables and the right port, give it a domain, switch on HTTPS, add a health check, and run a deploy checklist.

    12 minFull access

  6. Go deeper: valet keys and corner shops

    After this deck you can walk through the OAuth authorization code flow (with PKCE), say what an access token can and cannot do, and explain how a CDN and the edge make a site fast without serving anyone stale or private data.

    13 minFull accessGo deeper · optional

Labs

Python in the browser, next to the lessons.

Weekend build

Skills you prove

Deploy
Deploy with tracing and dashboards for cost per task and latency

Hand-picked official docs, papers and talks.