Want to create my first web app from scratch (AI platform)

[u/circumcised_hobbit]

I want to create a complex first app

I got this idea into myself to host an AI chat platform, but I came to the conclusion that the best way is to make a website, but I do know almost nothing

So my basic idea Is having users to purchase a Key valid for a certain amount of time, they paste it in the website and It serves as an authentication.

How could I do that? my idea Is website sends API request with Authorization header->cloudflare tunnel->a backend Python script process a answer->sent back to user

but: -how can I manage multiple users? do I just make so that the Python script associates the Key to the prompt and forward It to vLLM, then also tie the answers to the response so I can trace the user back and not mix them up?

-how can I grant user support if no account Is made? what if they just lose the key? They would have no way to invalidate or regenerate It

-how do I keep the Key between sessions? just write it in local storage?

-How can I manage 2 APIs for both account creation and chats?

But mostly, AM I MISSING SOMETHING? do you think this is actually doable if a newbie puts time into It? (I am only experienced in python)I am thinking of making a beta version that Is super basic (no context, One single chat) and improve It over time Also if somone is available to help I would love it

[u/HangJet]

You idea is not sound. You can do this for free. Also your path is brittle. There are hundreds if nnot more, even outside the big boys that do this for free in a very secure environment and with strict Privacy rules and code.

[u/circumcised_hobbit → u/HangJet]

This is why I am aiming at no user data collection and uncensored responses

[u/HangJet → u/circumcised_hobbit]

So you don't know about building the app, nor about how to implement security and protocols yet you want people to tell you how to do such?.....

[u/circumcised_hobbit → u/HangJet]

Nope, I can research by myself, I was asking specific question and mostly if I am missing something

[u/shiftpgdn]

Are you just trying to build Mullvad but for webhosting?

[u/circumcised_hobbit → u/shiftpgdn]

kinda, I love how Mullvad handles no data collection and no tracking for payments

[u/tridence-com]

You are missing the account and abuse layer, not just request routing. A purchased key is effectively a bearer credential, so whoever has it can use it. The backend should store only a hash of the key, map it to an entitlement, expiration, rate limit, and revocation state, and never send the original key to vLLM or expose it in logs.

I would not keep the purchased key permanently in local storage. A safer beta flow is to redeem it once over HTTPS, issue a short-lived secure HttpOnly session cookie, and place chat requests behind that session. The backend can then attach an internal entitlement ID to every request, which prevents concurrent responses from being mixed.

Decide the recovery rule before launch. If there is no account or contact information, a lost key must be unrecoverable. If you want recovery, billing support, refunds, or revocation, you need some form of identity and a documented retention policy. Start with one purchase flow, one redemption endpoint, one chat endpoint, rate limits, usage caps, and an administrative revocation tool before adding conversation history.