Mobile App Banner Design: PowerAMS Multi-Platform Case Study
 – 1600 × 1200 px.png)
When someone scrolls past your mobile app on Instagram, LinkedIn, or Dribbble, you get about half a second to earn a second look. That's the actual window. Anything that takes longer to read, parse, or recognize gets scrolled past.
For PowerAMS — a membership and event management app we recently worked on — we needed a launch banner system that could survive that half-second test across seven different platforms, each with its own dimensions, audience, and visual conventions. Here's how we approached it, what we decided, and what the final system looks like.
The brief
PowerAMS came to us needing launch visuals that could:
- Communicate the app's core value — fast, seamless event access — in under two seconds
- Work natively on Dribbble, Behance, Instagram, Facebook, LinkedIn, X (Twitter), and YouTube
- Feel premium without feeling decorative
- Hold up at both portrait and landscape aspect ratios
- Pull double duty as portfolio work and as marketing collateral
Most banner systems break down somewhere in that list. Either the composition only works at one size, or the message gets lost when the image is cropped for another platform, or the whole thing ends up feeling like a template instead of a brand asset.
Four decisions that shaped the design
A single hero composition, cropped intelligently. Rather than designing seven different banners, we built one master composition with the phone mockup positioned so it could be cropped to portrait (Instagram), landscape (LinkedIn, Facebook, X), and wide landscape (Dribbble, Behance) without losing the focal point. The hand holding the device sits roughly in the center-right of the canvas, giving us room to pull tighter or wider depending on the format.
Typography as the loudest element. "ACCESS EVENTS IN SECONDS" is set in a heavy display sans, with the action phrase highlighted in a contrasting electric blue. The hierarchy is deliberate — your eye lands on the headline first, drops to the supporting tagline, then to the phone screen. Any banner that relies on the user reading the app interface to understand the value will fail. The headline has to carry it.
A restrained color system. The whole composition lives in a clean off-white and electric blue palette. Cool, modern, and — critically — readable across every platform's chrome. Dark-mode X users don't lose contrast. LinkedIn's professional context isn't disrupted. Dribbble shows it clean against gray.
Brand vocabulary in the background. The faded "POWER EVENT" wordmark behind the phone adds depth without competing with the headline. It's the kind of detail that reads as intentional craft rather than decoration, and it ties the banner back to the brand even when the logo is small.
Designing for seven platforms
Here's how we sized each piece and why each one needed its own treatment:
Dribbble — 1600 × 1200 px. The portfolio shot. Wider crop, more breathing room, designed to be browsed in a feed of design work. Less hard sell, more visual statement.
Behance — full case study layout. This is the long-form play. The Dribbble shot, the Instagram portrait, and the process behind both, packaged as a project page that potential clients can dig into.
Instagram Portrait — 1080 × 1350 px. The tallest, most attention-dense format. The headline gets more vertical room, the phone sits prominently, and less peripheral content competes for the eye.
Facebook — 1200 × 630 px. Standard link-share dimensions. Designed to render cleanly when shared as a link preview, and to double as the OG image for blog distribution.
X (Twitter) — 1200 × 675 px. Almost the same aspect ratio as Facebook, slightly different proportions. We adjusted the crop to keep the headline safe from any UI overlays.
LinkedIn — 1200 × 627 px. The professional-context version. Same composition, but we tightened the framing because LinkedIn feeds are denser and images get less real estate.
YouTube — thumbnail and end-card support. Designed to be readable at the small thumbnail size that YouTube renders in search and suggested videos. Anything that fails the thumbnail test fails everywhere.
Five rules we'd give anyone designing a mobile app banner
Start with the smallest size, not the largest. If your composition works at LinkedIn dimensions (1200 × 627) and at YouTube thumbnail scale, it'll work at 1600 × 1200. The reverse is rarely true — beautiful Dribbble shots often collapse when you crop them down.
Treat the phone mockup as a supporting element, not the hero. People scroll past phone mockups every day. The headline and the brand color carry the recognition; the mockup adds context.
Build a system, not seven one-offs. Decide once on typography, color, mockup angle, and background treatment. Then adapt only the crop and aspect ratio. This is what makes a launch feel coordinated rather than scattered across channels.
Account for dark mode and light mode. Test your design in both. Most banners are designed assuming a clean white feed; on X in dark mode, that same design often looks too bright and washes out.
Leave room for platform UI overlays. Instagram caption text, LinkedIn engagement buttons, X reply icons — all of these eat into your design. Keep your headline clear of the bottom 15% of any image.
Final thoughts
Mobile app banner design isn't about making something pretty. It's about building a visual system that survives compression, cropping, dark mode, and a half-second attention window — while still communicating the app's core promise.
The PowerAMS launch is one example of how we approach it at Craxinno. If you're shipping a mobile app and need a launch creative that works across every channel from day one, get in touch — we'd love to help.
Have something to build?
Design and engineering under one roof — we scope it, build it, and stay for the long tail.
Start a projectKeep ReadingMore case studies like this
Engineering retros, product launches, and brand systems from our studio — updated monthly.
All case studiesTechnology Used
FigmaTags & Keywords
Continue with Blogs.
View all blogs
SaaS DevelopmentBest Tech Stack for a SaaS Startup in 2026: What We'd Pick and What It Costs
Short answer: The best tech stack for a SaaS startup in 2026, for most teams, is TypeScript end to end : Next.js 16 and React 19 on the front, PostgreSQL (through Supabase or Neon) with Drizzle ORM for data, managed auth, Stripe or a Merchant of Record for billing, Vercel for hosting, and pgvector plus a model API for AI features. Boring on purpose. Boring ships. That's the answer we give founders on discovery calls, and it rarely changes. At Craxinno we've shipped 200+ web apps since 2017, and the stack conversation almost never decides whether a SaaS product succeeds. What it does decide is how fast you can ship the next feature, how easily you can hire, and whether you'll be stuck rewriting your billing code in month 14 instead of selling. So this guide to the best tech stack for a SaaS startup skips the "top 25 frameworks" roundup. You'll get one opinionated default stack, the reasoning behind each layer, what it costs per month, and the specific situations where you should throw our advice out. The 2026 SaaS Tech Stack at a Glance Layer Our default pick Swap it when... Language TypeScript Your product is mostly ML or data work → Python Frontend Next.js 16 + React 19 The app is 100% behind a login and SEO doesn't matter → Vite + React SPA UI Tailwind CSS + shadcn/ui You hire a designer and need a custom design system Backend/API Next.js route handlers, then a Node.js service (Hono or NestJS) Heavy AI pipelines → FastAPI. Very high throughput → Go Database PostgreSQL (Supabase or Neon) Almost never. Seriously ORM Drizzle Your team already knows Prisma well Auth Supabase Auth or Better Auth You want hosted UI in an afternoon → Clerk. Enterprise SSO → WorkOS Payments Stripe You sell globally and don't want to file taxes → Paddle, Lemon Squeezy or Polar. Indian customers paying in INR → Razorpay Hosting Vercel + managed Postgres Steady heavy compute, long jobs or strict compliance → AWS Background jobs Inngest or Trigger.dev High-volume queues → BullMQ on Redis or RabbitMQ Email Resend Very high volume → AWS SES Analytics PostHog You only need traffic stats → Plausible Error tracking Sentry (Rarely worth swapping) AI layer OpenAI / Claude APIs + pgvector RAG, agents or self-hosted models at scale → Python service on GPU infra Now the why, layer by layer. We spend a lot more time on the database and payments than on CSS, because that's where the expensive mistakes live. Why TypeScript End to End Wins for Most SaaS Startups One language from the database schema to the button component. That's the whole argument, and it's a strong one. When your Drizzle schema, your API responses and your React props share the same types, a renamed column breaks the build instead of breaking production. A three-person team can move between frontend and backend tickets without context switching between languages. And hiring is easier: TypeScript and React developers are the deepest talent pool you'll find in India, the US or Eastern Europe. There's a 2026-specific reason too. Most teams now write a big chunk of their code with AI assistants like Claude , Cursor or Copilot. Those tools are noticeably more reliable on mainstream, well-documented stacks than on niche ones, simply because there's far more public TypeScript and Next.js code for them to have learned from. Picking a popular stack is now also picking the stack your AI pair programmer writes best. (The counter-case: if your founding engineer is a Django or Rails veteran who can ship a feature a day, let them. Team fluency beats trend fluency every time. More on that below.) Read more about how we use TypeScript on client projects. Frontend: Next.js 16, With One Honest Caveat Next.js 16 wen t stable on October 21, 2025 , with Turbopack as the default bundler and React 19.2 support. For a SaaS product, it gives you the marketing site, the blog, the docs and the logged-in app in a single codebase, with server rendering where Google needs it and client interactivity where users need it. Pair it with Tailwind CSS and shadcn/ui. You copy components into your repo instead of installing a black-box library, so you own every line and can restyle anything without fighting a theme API. The caveat. Next.js's App Router, server components and caching model have a real learning curve. If your product is a dashboard that lives entirely behind a login, with no public pages that need to rank, a plain Vite + React single-page app is simpler to reason about and cheaper to host. Put your marketing site on a separate Next.js or static build and move on. Database: Just Use PostgreSQL This is the one decision we'd defend in any argument. PostgreSQL was used by 55.6% of all respondents in the 2025 Stack Overflow Developer Survey , and it ranked first for both "admired" (65.5%) and "desired" (46.5%). Popularity isn't the reason to pick it, though. The reason is that Postgres alone covers what used to take three databases: Relational data for users, organizations, subscriptions and invoices JSONB columns for the flexible, schema-light data people used to reach for MongoDB to store Full-text search that's good enough until you have hundreds of thousands of documents Vector search through pgvector, so your AI features don't need a separate vector database on day one Supabase or Neon? Supabase gives you Postgres plus auth, storage and realtime in one dashboard, and its Pro plan is $25/month per organization. Neon is a leaner serverless Postgres with database branching that's handy for preview environments. Both are plain Postgres underneath, which means you can migrate to AWS RDS later with a dump and restore. That exit path matters. Plan multi-tenancy on day one Every B2B SaaS is multi-tenant, and the cheapest time to design for it is before your first table exists. Our default: a shared schema where every tenant-owned table carries an organization_id , enforced with Postgres row-level security. Schema-per-tenant or database-per-tenant only makes sense when an enterprise contract demands data isolation, and you can add it for that one customer later. One production gotcha we see in audits: RLS policies that filter on organization_id without an index on that column. Everything works fine at 1,000 rows and crawls at 1,000,000. Index the tenant column on every table. It's a one-line fix that saves a very bad week. Authentication: Don't Build It Yourself You can write a login form in an hour. You can't write password resets, email verification, rate limiting, session rotation, OAuth, MFA and SAML SSO in an hour, and every one of those will eventually be asked for. Your realistic options in 2026: Supabase Auth if you're already on Supabase. The free plan covers up to 50,000 monthly active users and Pro covers 100,000, which is plenty for most early SaaS products. Better Auth if you want an open-source library that stores everything in your own Postgres, with plugins for organizations and SSO. Clerk if you want polished, prebuilt sign-in UI and are fine paying per user as you grow. WorkOS when your first enterprise prospect asks for SAML SSO and SCIM provisioning. Whichever you pick, model organizations, members and roles from the start. Retrofitting "teams" into an app built around single users is one of the most expensive refactors we get hired for. Payments: Stripe vs. a Merchant of Record (and the India Question) Billing is where SaaS founders lose the most time, so think about it earlier than feels necessary. Stripe is the default for good reason: excellent subscription APIs, a hosted customer portal and the best developer docs in payments. The standard US card rate is 2.9% + 30¢ per successful charge. The catch is that you are the seller, so sales tax, VAT and GST compliance are your problem (Stripe Tax helps, for an extra fee). A Merchant of Record (Paddle, Lemon Squeezy, Polar) becomes the legal seller of your software. They charge more per transaction, but they calculate, collect and remit taxes in every country for you. For a two-person team selling worldwide, that trade is usually worth it. If you're a founder in India , there's one more wrinkle. Stripe moved to invite-only onboarding for new Indian businesses in 2024 . The two common routes: Set up a US entity (Delaware or Wyoming are the usual picks; Craxinno itself runs a US entity out of Cheyenne, Wyoming) and use Stripe or a Merchant of Record for international customers. Use Razorpay for Indian customers paying in INR, including UPI AutoPay for recurring subscriptions. Plenty of Indian SaaS companies end up running both: Razorpay for domestic billing, Stripe or a Merchant of Record for everyone else. Build a thin billing layer in your code so the provider is swappable. We've done enough payment gateway integrations to know that "we'll only ever need one provider" doesn't survive the first enterprise deal. Hosting and Infrastructure: Start Managed, Move When the Bill Tells You To Start on Vercel for the Next.js app and a managed Postgres host for data. Zero servers to patch, preview deployments for every pull request, and deploys that take minutes. One thing founders miss: Vercel's free Hobby plan is restricted to non-commercial, personal use . The moment you charge customers, you need Pro at $20 per developer seat per month. When should you move to AWS ? Watch for these signals: Your Vercel function and bandwidth bill has become a meaningful line item every month You have long-running jobs (video processing, large imports, model inference) that don't fit serverless time limits An enterprise customer or regulation requires a specific data region, a signed BAA or a dedicated VPC You need a mix of always-on workers, queues and GPUs Even then, skip Kubernetes. ECS on Fargate, or a platform like Railway or Fly.io, covers most SaaS workloads well into the millions of requests without a dedicated DevOps hire. The AI Layer Is Now Part of the Default Stack In 2026, customers expect at least one AI feature in a SaaS product: a smart search, a summary, a draft, an agent that does the boring part of the workflow. So plan for it in the architecture instead of bolting it on. Stage 1: call models from your TypeScript backend. Use the Vercel AI SDK (or the official SDKs) to call OpenAI or Anthropic's Claude . Store embeddings in pgvector, in the same Postgres database as everything else. This handles AI search, summarization, chat over your users' data and simple tool-calling agents. Most startups never need to leave this stage. Stage 2: add a Python service when the work gets heavy. Python still owns the AI ecosystem. Once you're building multi-step RAG pipelines, parsing messy PDFs at volume, running evaluations or hosting open-source models on GPU providers like RunPod, stand up a separate FastAPI service. Your Next.js app talks to it over HTTP for quick calls and through a queue (Inngest, BullMQ or RabbitMQ) for long-running jobs. Four habits save real money here: Meter tokens per tenant from the first AI feature. Otherwise one heavy customer quietly eats your margin. Route by difficulty. Send easy tasks to a small, cheap model and escalate only the hard ones. Cache repeated requests. Identical prompts (the same document summary, the same FAQ answer) shouldn't hit the model twice. Log every prompt and output so you can evaluate quality before swapping models. What This SaaS Stack Actually Costs Per Month List prices at the time of writing. Always check the vendor's pricing page before you budget, because these change often. Stage Setup Fixed monthly cost Building / pre-revenue Vercel Hobby, Supabase Free, Resend Free (3,000 emails/month), PostHog and Sentry free tiers $0 First paying customers Vercel Pro (1 seat, $20), Supabase Pro ($25), Resend Pro ($20 for 50,000 emails) ~$65 + AI usage Growing team Add a Vercel seat per developer ($20 each), paid Sentry and PostHog tiers as volume grows, larger database compute Scales with usage, not with a big jump On top of fixed costs you pay variable fees: Stripe's 2.9% + 30¢ per card charge (or a higher Merchant of Record rate) and your LLM token spend. For AI-heavy products, token spend is often the biggest infrastructure line by far, which is why per-tenant metering matters so much. Two warnings. Supabase's free projects pause after 7 days of inactivity, so don't run a demo for investors on one. And Vercel Hobby isn't allowed for commercial use, so budget for Pro on launch day. When You Should Ignore This Stack A default is a starting point, not a rule. Break it when: Your team is already fast in something else. A senior Django, Rails or Laravel developer will ship a SaaS MVP faster in their framework than in a stack they're learning. Their admin panels and conventions are a gift at MVP stage. The core product is AI or data science. If 80% of the work is models and pipelines, go Python-first: FastAPI and Postgres on the backend, a React frontend on top. You need extreme real-time throughput. Trading systems, IoT ingestion or multiplayer collaboration may need Go or Elixir services for the hot path. You're in a regulated industry from day one. Healthcare or fintech products should check every vendor for HIPAA BAAs, SOC 2 reports and data residency options before writing code. AWS-first is often simpler here. 6 Tech Stack Mistakes That Force a Rewrite We see these on almost every rescue project that comes through our door. Microservices on day one. A modular monolith is faster to build, easier to debug and simpler to deploy. Split services only when a specific part has different scaling or team needs. Building auth or billing in-house. Weeks of work, ongoing security liability, zero differentiation. No tenant model. Adding organization_id to 40 tables after launch, while keeping live customer data intact, is miserable. Choosing a database for scale you don't have. You aren't Netflix. Postgres on a modest instance handles more traffic than most SaaS products ever see. Proprietary data APIs without an exit plan. Firebase and similar platforms are quick to start with, but moving off a non-SQL proprietary backend later can mean a full data-layer rewrite. No error tracking or logs until the first outage. Sentry and structured logs take an hour to add. Debugging a production incident blind takes days. Security and Compliance: What to Have Before Your First Enterprise Deal Few stack guides cover this, yet it's exactly what stalls B2B deals. Enterprise buyers will send a security questionnaire. Have answers ready: Encryption in transit (TLS) and at rest (default on Supabase, Neon and RDS) Automated backups with point-in-time recovery, and a restore you've actually tested Role-based access control and audit logs for admin actions SSO/SAML on your roadmap, or available on a higher plan A data processing agreement covering GDPR for EU customers and India's Digital Personal Data Protection Act, 2023 for Indian users A path to SOC 2. Tools like Vanta or Drata make the first audit far less painful when your infra is already on mainstream cloud providers None of this requires a different stack. It requires choosing vendors that publish their own compliance reports, which every tool in our default stack does on its paid plans. How Craxinno Helps SaaS Founders Pick and Ship a Stack We're an AI-first design and development studio based in Jaipur, with a US entity in Wyoming. We've been building web apps, SaaS platforms and AI products since 2017, across Next.js, Node.js, Python (FastAPI, Django), AWS and payment gateway integrations. If you're choosing the best tech stack for a SaaS startup of your own, or you've inherited one that's slowing you down, we'll review it with you and tell you plainly what to keep and what to change. See how we work , browse projects we've shipped , or talk to us about your stack .
OpenAI APIHow to Build a Chatbot with the OpenAI API: Step-by-Step Python Tutorial
How to Build a Chatbot with the OpenAI API: Step-by-Step Python Tutorial Quick answer: To build a chatbot with the OpenAI API, install the openai Python SDK, save your API key in an environment variable, and send each user message to client.responses.create() with your system prompt in instructions . Pass the previous reply's ID back as previous_response_id so the bot remembers the conversation, then stream the output to a web page through a small backend. That's the whole idea. The rest of this tutorial turns it into code you can run in about 20 minutes. One warning first. Search "OpenAI chatbot tutorial" and a good share of the top results still call openai.ChatCompletion.create() . That function was removed when the Python SDK hit version 1.0 back in November 2023, and the SDK is on version 3.29 as of October 2026. Copy that code today and you get an error before your bot says hello. Everything below is written against the current Responses API and tested on openai 3.29.0. What you'll build A support assistant called Ava for a made-up coffee subscription brand, Brewly. By the end you'll have: A terminal chatbot that streams replies word by word and remembers earlier messages. A FastAPI backend that keeps your API key off the browser. A plain HTML chat page that talks to that backend. A clear idea of what each conversation costs you. Python 3.9 or newer and an OpenAI account with billing enabled are all you need. No frameworks like LangChain. You'll understand every line, which matters the first time something breaks in production. Responses API vs Chat Completions vs Assistants: which one? OpenAI has three APIs that can power a chatbot, and older tutorials mix them up. API Status (Oct 2026) Who manages conversation history Use it for Responses API Recommended for all new projects You, or OpenAI via previous_response_id / Conversations New chatbots and agents Chat Completions Still supported You (resend the messages array) Existing apps you don't want to migrate yet Assistants API Listed under legacy APIs OpenAI (threads) Nothing new OpenAI's own migration guide says Responses is "recommended for all new projects," and reports 40–80% better cache utilization than Chat Completions in internal tests. Better cache hits mean lower bills on long chats, which is reason enough for a chatbot. So this tutorial uses the Responses API throughout. Step 1: Set up the project and your API key Create a folder, a virtual environment and install four packages: 1 2 3 4 mkdir openai - chatbot && cd openai - chatbot python - m venv . venv source . venv / bin / activate # Windows : . venv\Scripts\activate pip install openai python - dotenv fastapi uvicorn Generate a key at platform.openai.com → API keys , then create a .env file in the project folder: 1 2 OPENAI_API_KEY = sk - proj - your - key - here OPENAI_MODEL = gpt - 6 - luna Add .env to .gitignore right now, before your first commit. Leaked keys get scraped from public GitHub repos within minutes, and the bill lands on your account. What goes wrong here: if you see OpenAIError: Missing credentials. Please pass an api_key... , the SDK can't find the variable. Check that load_dotenv() runs before OpenAI() is created and that you started Python from the folder containing .env . Step 2: Send your first request Create hello.py : 1 2 3 4 5 6 7 8 9 from dotenv import load_dotenv from openai import OpenAI load_dotenv ( ) client = OpenAI ( ) # reads OPENAI_API_KEY from the environment response = client . responses . create ( model = "gpt-6-luna" , input = "Explain what an API key is in one sentence." , ) print ( response . output_text ) Run python hello.py . If a sentence comes back, your account, key and billing all work. response.output_text is a convenience property that joins all the text the model produced. The full response.output list also holds reasoning items and tool calls, which you'll need later for memory. Which model should a chatbot use? These are the current text models and their prices per 1 million tokens, from OpenAI's models page: Model Input Output Good for gpt-6-luna $0.10 $0.50 FAQ and support bots, high volume, fastest replies gpt-6.1-sol $2 $10 Bots that need to reason over policies, data or code gpt-6-astra $10 $50 Hard, high-value queries where accuracy beats cost Our take: start every chatbot on Luna. Most customer-facing questions ("where's my order?", "can I change my plan?") don't need a frontier model, and Luna costs 1/20th of Sol. Upgrade only the conversations that need it. Because the model name lives in .env , switching is a one-line change. Step 3: Give the bot a personality and rules with a system prompt Without instructions, the model answers anything about anything. A support bot needs a job description. In the Responses API, that goes in the instructions parameter: 1 2 3 4 5 6 7 8 9 10 11 SYSTEM_PROMPT = """You are Ava, the support assistant for Brewly, an online coffee subscription. - Only answer questions about orders, subscriptions, shipping and coffee. - Keep replies under 80 words unless the user asks for more detail. - If you are not sure, say so and point the user to help@brewly.example. - Never invent order numbers, prices or delivery dates.""" response = client . responses . create ( model = "gpt-6-luna" , instructions = SYSTEM_PROMPT , input = "Can I pause my subscription for a month?" , ) print ( response . output_text ) A few things we've learned writing system prompts for client bots: Rules beat adjectives. "Keep replies under 80 words" works. "Be concise" gets interpreted loosely. Tell it what to do when it doesn't know. The fallback line (email support) is what stops a bot from making up a refund policy. Ban the specific lies. Order numbers and delivery dates are what support bots most love to invent, so the prompt names them. If you want to go deeper on wording, our guide to prompt engineering covers structure and testing. Step 4: Add conversation memory (three ways) Ask the bot from Step 3 "Can I pause my plan?", then follow up with "What about two months?" It has no idea what you mean. Every API call starts with a blank slate, because the model is stateless. You have three ways to fix that. Approach How it works Where history lives Best for A. Manual history Append every message and reply to a list, send the whole list each time Your app Full control, store=False for sensitive data B. previous_response_id Pass the last reply's ID; OpenAI fills in the earlier turns OpenAI (responses kept 30 days by default) Terminal bots, short sessions C. Conversations API Create a conversation object once, attach every response to it OpenAI (no 30-day expiry) Web apps where users come back later One thing none of the three changes: you pay for the history every turn. OpenAI's docs say it directly: with previous_response_id , "all previous input tokens for responses in the chain are billed as input tokens." Server-side memory saves you code, not tokens. Option A: manual history (stateless) 1 2 3 4 5 6 7 8 9 10 11 history = [ ] def ask ( user_text ) : history . append ( { "role" : "user" , "content" : user_text } ) response = client . responses . create ( model = "gpt-6-luna" , instructions = SYSTEM_PROMPT , input = history , store = False , # nothing kept on OpenAI's side ) history . extend ( response . output ) # keep ALL output items, not just the text return response . output_text Note history.extend(response.output) . OpenAI's conversation-state guide says to keep every output item so reasoning items stay intact. Appending only output_text as a string works on simple models and quietly degrades answers on reasoning ones. Option B: previous_response_id (the terminal chatbot) This is the full, runnable terminal bot. Save it as chat.py : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 import os from dotenv import load_dotenv from openai import OpenAI load_dotenv ( ) client = OpenAI ( ) MODEL = os . getenv ( "OPENAI_MODEL" , "gpt-6-luna" ) SYSTEM_PROMPT = """You are Ava, the support assistant for Brewly, an online coffee subscription. - Only answer questions about orders, subscriptions, shipping and coffee. - Keep replies under 80 words unless the user asks for more detail. - If you are not sure, say so and point the user to help@brewly.example. - Never invent order numbers, prices or delivery dates.""" def main ( ) : previous_id = None print ( "Ava is ready. Type 'quit' to exit.\n" ) while True : user_text = input ( "You: " ) . strip ( ) if user_text . lower ( ) in { "quit" , "exit" } : break if not user_text : continue stream = client . responses . create ( model = MODEL , instructions = SYSTEM_PROMPT , # resend every turn input = user_text , previous_response_id = previous_id , reasoning = { "effort" : "low" } , stream = True , ) print ( "Ava: " , end = "" , flush = True ) for event in stream : if event . type == "response.output_text.delta" : print ( event . delta , end = "" , flush = True ) elif event . type == "response.completed" : previous_id = event . response . id print ( "\n" ) if __name__ == "__main__" : main ( ) Run python chat.py , ask about pausing, then ask "what about two months?" Ava now knows what "that" refers to. See the comment # resend every turn ? That's the bug that catches almost everyone. The SDK documentation says that with previous_response_id , "the instructions from a previous response will not be carried over to the next response." Send instructions only on the first call and by turn three Ava has forgotten she's a coffee bot and will happily write you a cover letter. Option C: the Conversations API For a web app, a user might close the tab and come back tomorrow. A conversation object survives that, and unlike stored responses it isn't subject to the 30-day TTL: 1 2 3 4 5 6 7 conversation = client . conversations . create ( ) response = client . responses . create ( model = "gpt-6-luna" , instructions = SYSTEM_PROMPT , input = "Can I pause my plan?" , conversation = conversation . id , ) Save conversation.id against your user record and pass it back on every message. We'll use this in the web version. Step 5: Stream replies instead of waiting You already saw streaming in chat.py , but it deserves its own section because it changes how the bot feels more than any model upgrade. Without streaming, the user types a question and stares at nothing for two, three, four seconds while the whole answer generates. Then a wall of text appears. With streaming, the first words show up almost immediately and the reply types itself out. Same total time. Completely different experience. The mechanics are two lines: pass stream=True , then loop over events and print the ones of type response.output_text.delta . Other events you'll see include response.created , response.completed (which carries the final response object and its ID) and error . Step 6: Put the chatbot on a web page with FastAPI Here's where a lot of tutorials go wrong. They call the OpenAI API straight from browser JavaScript, which means shipping your API key to every visitor. Anyone who opens dev tools can copy it and run up your bill. The fix is a thin backend. The browser talks to your server; only your server talks to OpenAI. Create app.py : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 import os from dotenv import load_dotenv from fastapi import FastAPI from fastapi . responses import FileResponse , StreamingResponse from openai import OpenAI from pydantic import BaseModel , Field load_dotenv ( ) client = OpenAI ( timeout = 30 , max_retries = 3 ) MODEL = os . getenv ( "OPENAI_MODEL" , "gpt-6-luna" ) SYSTEM_PROMPT = """You are Ava, the support assistant for Brewly, an online coffee subscription. - Only answer questions about orders, subscriptions, shipping and coffee. - Keep replies under 80 words unless the user asks for more detail. - If you are not sure, say so and point the user to help@brewly.example. - Never invent order numbers, prices or delivery dates.""" app = FastAPI ( ) class ChatIn ( BaseModel ) : conversation_id : str message : str = Field ( min_length = 1 , max_length = 2000 ) @app . get ( "/" ) def home ( ) : return FileResponse ( "index.html" ) @app . post ( "/conversations" ) def new_conversation ( ) : conversation = client . conversations . create ( ) return { "conversation_id" : conversation . id } @app . post ( "/chat" ) def chat ( body : ChatIn ) : def generate ( ) : stream = client . responses . create ( model = MODEL , instructions = SYSTEM_PROMPT , input = body . message , conversation = body . conversation_id , reasoning = { "effort" : "low" } , max_output_tokens = 800 , stream = True , ) for event in stream : if event . type == "response.output_text.delta" : yield event . delta return StreamingResponse ( generate ( ) , media_type = "text/plain" ) Three small details doing real work here: max_length=2000 on the message stops someone pasting a novel into your bot and charging you for it. FastAPI rejects it with a 422 before OpenAI is ever called. max_output_tokens=800 caps the reply cost. Reasoning tokens count toward this limit, so don't set it too tight or replies get cut off. OpenAI(timeout=30, max_retries=3) raises the SDK's default of 2 automatic retries, which covers most brief rate-limit and network blips. Now the front end. Create index.html in the same folder: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 <! doctype html > < html lang = " en " > < head > < meta charset = " utf-8 " > < title > Brewly Assistant </ title > </ head > < body > < div id = " log " > </ div > < form id = " chat-form " > < input id = " msg " autocomplete = " off " placeholder = " Ask about your order... " > < button > Send </ button > </ form > < script > const log = document.getElementById("log"); let conversationId = null; function addLine(who, text) { const p = document.createElement("p"); p.textContent = `${who}: ${text}`; // textContent, never innerHTML log.appendChild(p); return p; } document.getElementById("chat-form").addEventListener("submit", async (e) => { e.preventDefault(); const input = document.getElementById("msg"); const text = input.value.trim(); if (!text) return; input.value = ""; if (!conversationId) { const res = await fetch("/conversations", { method: "POST" }); conversationId = (await res.json()).conversation_id; } addLine("You", text); const botLine = addLine("Ava", ""); const res = await fetch("/chat", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ conversation_id: conversationId, message: text }), }); const reader = res.body.getReader(); const decoder = new TextDecoder(); let reply = ""; while (true) { const { done, value } = await reader.read(); if (done) break; reply += decoder.decode(value, { stream: true }); botLine.textContent = `Ava: ${reply}`; } }); </ script > </ body > </ html > Start the server: 1 uvicorn app : app -- reload Open http://127.0.0.1:8000 and chat. That's a working, streaming, memory-aware chatbot in roughly 130 lines across two files. (The textContent comment isn't decoration. Model output rendered with innerHTML is an XSS hole: a user can talk the bot into returning a <script> tag. If you later want Markdown formatting, run it through a sanitizer such as DOMPurify first.) For a production widget with a launcher bubble, mobile layout and analytics, see our walkthrough on how to add AI chat to your website . How much does an OpenAI chatbot cost to run? Less than most people expect, if you pick the model deliberately. Take a typical support chat: a 300-token system prompt, 10 back-and-forth turns, user messages around 50 tokens and replies around 150. Because earlier turns are re-billed as input each time, the 10 turns add up to roughly 12,500 input tokens and 1,500 output tokens. Model Cost per 10-turn conversation Cost per 10,000 conversations gpt-6-luna ~$0.002 ~$20 gpt-6.1-sol ~$0.04 ~$400 gpt-6-astra ~$0.20 ~$2,000 These are estimates from list prices. They leave out reasoning tokens (billed as output) and cached-input discounts, which push in opposite directions. Measure your real numbers from response.usage after a week of traffic. The pattern that matters: cost grows with conversation length , not just count, because every turn re-sends the history. Two ways to keep long chats in check: Trim manual history. With Option A, keep the system prompt plus the last 10–20 items. Turn on server-side compaction. Pass context_management=[{"type": "compaction", "compact_threshold": 200000}] and OpenAI compresses older context once the conversation crosses that token count. Our full playbook on reducing LLM API costs covers caching, routing and batching in more depth. If you're budgeting a whole project rather than API calls, see what an AI chatbot costs to build in 2026 . Common mistakes (and the fix for each) AttributeError: module 'openai' has no attribute 'ChatCompletion' You copied pre-2023 code. Use client = OpenAI() and client.responses.create() . 400 Bad Request mentioning temperature GPT-6 models don't accept temperature , top_p or top_logprobs while reasoning is switched on. Remove them. Control tone through the system prompt instead. (On Luna you can set reasoning={"effort": "none"} if you really need sampling controls.) The bot forgets its role after a few messages You only sent instructions on the first call. With previous_response_id , resend them every turn. Replies stop mid-sentence max_output_tokens is too low. Reasoning tokens eat into it before visible text does. Raise the cap or lower the reasoning effort. RateLimitError (429) under load The SDK retries automatically, but sustained traffic needs a queue or per-user rate limit on your side. Check your usage tier in the OpenAI dashboard. Before you go live: a short production checklist The tutorial bot works. A public bot needs a bit more: Authenticate users and rate-limit per user. An open /chat endpoint is a free LLM for the whole internet. Send a safety_identifier . It's a stable per-user ID (OpenAI recommends hashing the email or username) that helps OpenAI detect abuse coming through your app without flagging your whole account. Decide on data retention. Responses are stored for 30 days by default. For health, finance or other sensitive data, use manual history with store=False . Log every conversation on your side. You can't improve a prompt you can't read. Review 20 real chats a week and you'll find the gaps fast. Write a test set. Twenty questions with expected answers, run after every prompt change, catches regressions before customers do. Give the bot real knowledge. A system prompt can't hold your entire help center. That's what retrieval is for. Where to go next: from chatbot to something useful Right now Ava is polite but knows nothing about Brewly's actual policies or orders. The next two upgrades fix that: Retrieval-augmented generation (RAG) lets the bot answer from your own documents. Upload them to a vector store and give the model the file_search tool, or build your own pipeline. Start with how RAG works , and if you're weighing it against training a custom model, read RAG vs fine-tuning . Function calling lets the bot do things: look up an order, pause a subscription, book a call. At that point it stops being a chatbot and starts being an agent. Here's the difference in practice: AI agents vs chatbots . Need a chatbot built for your business? This tutorial gets you a working prototype in an afternoon. Getting from prototype to a bot that knows your products, connects to your CRM or order system, and holds up under real traffic is where most of the work lives. That's the work our AI development team does: RAG chatbots, support agents and LLM integrations built in Python and FastAPI and shipped to production. Tell us what you're building and we'll tell you honestly whether you need us or this tutorial is enough.
StripeHow to Add Stripe Payments to a Next.js App
How to Add Stripe Payments to a Next.js App Adding Stripe payments to a Next.js app takes about 30 minutes with the modern approach, and it is simpler than most tutorials make it look. The trick is to use Stripe Checkout , Stripe’s own hosted payment page, rather than building your own card form. You create a checkout session on the server, redirect the user to Stripe to pay, and Stripe sends you back. You never handle raw card details, which makes it faster to build and far more secure. This guide walks through the whole thing, step by step, for the Next.js App Router. Here is the one principle that matters more than any line of code, and the thing beginners get wrong: never trust the browser to confirm a payment. A user can close the tab, lose connection, or tamper with the page after paying. The only reliable way to know a payment succeeded is a webhook, a message Stripe sends directly to your server. Getting the webhook right is what separates a real integration from one that silently loses orders, so this guide treats it as essential, not optional. This guide covers setup, the checkout flow, the all-important webhook, testing, and going live. The quick answer: the whole flow If you want the shape of it first, here is what you are building. Install Stripe and add your API keys to environment variables. Create a server route that makes a Stripe Checkout session and returns its URL. Add a button that calls that route and redirects the user to Stripe to pay. Create a webhook route that listens for Stripe’s confirmation and fulfills the order (this is the critical part). Test locally with the Stripe CLI, then add your live keys and production webhook to go live. The golden rule throughout: Stripe Checkout handles the payment UI and card security for you, and the webhook, not the browser, is the source of truth for whether a payment actually happened. Prerequisites Get these in place first. A Next.js app using the App Router (Next.js 13 or newer), and Node.js 18 or newer. A Stripe account (free to create), with access to your API keys in the Stripe Dashboard. You will use test keys while building. Basic familiarity with Next.js API routes (route handlers) and environment variables. Step 1: Install Stripe and set up your keys Install the Stripe packages: npm install stripe @stripe/stripe-js Then add your keys to a .env.local file in your project root (use your test keys while building): STRIPE_SECRET_KEY=sk_test_your_key NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_test_your_key STRIPE_WEBHOOK_SECRET=whsec_your_secret NEXT_PUBLIC_APP_URL= http://localhost:3000 Add .env.local to your .gitignore so your secret keys never reach your repository. The secret key must stay on the server only; the publishable key (prefixed NEXT_PUBLIC_) is safe in the browser. It also helps to create one shared Stripe client. Make a file at lib/stripe.ts: import Stripe from “stripe”; export const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!); Now every route can import the same configured client. Step 2: Create the checkout session route This server route creates a Stripe Checkout session and returns its URL. Create app/api/checkout/route.ts: import { NextResponse } from “next/server”; import { stripe } from “@/lib/stripe”; export async function POST() { const session = await stripe.checkout.sessions.create({ mode: “payment”, line_items: [ { price_data: { currency: “usd”, product_data: { name: “Your Product” }, unit_amount: 2000, // $20.00, in cents }, quantity: 1, }, ], success_url: ${process.env.NEXT_PUBLIC_APP_URL}/success , cancel_url: ${process.env.NEXT_PUBLIC_APP_URL}/cancel , }); return NextResponse.json({ url: session.url }); } A few notes: amounts are in the smallest currency unit (cents), mode is “payment” for a one-time purchase (use “subscription” for recurring), and success_url and cancel_url are where Stripe sends the user after. The route returns session.url, the hosted Stripe page you will redirect to next. Step 3: Add the checkout button On your page, add a button that calls the route and redirects the user to Stripe. In a client component: “use client”; export default function CheckoutButton() { async function handleClick() { const res = await fetch(“/api/checkout”, { method: “POST” }); const data = await res.json(); window.location.href = data.url; // redirect to Stripe } return <button onClick={handleClick}>Buy now</button>; } That is the entire customer-facing flow: the user clicks, your route makes a session, and the browser sends them to Stripe’s secure page to enter card details. You never touch the card data. Step 4: Create the webhook (the critical part) This is the step that makes the integration trustworthy. After a payment, Stripe sends a message to your server confirming it. You listen for that message and fulfill the order, send the product, mark it paid, email the receipt. Create app/api/webhooks/stripe/route.ts: import { NextResponse } from “next/server”; import { headers } from “next/headers”; import { stripe } from “@/lib/stripe”; import Stripe from “stripe”; export async function POST(req: Request) { const body = await req.text(); // CRITICAL: raw text, not JSON const signature = (await headers()).get(“stripe-signature”)!; let event: Stripe.Event; try { event = stripe.webhooks.constructEvent( body, signature, process.env.STRIPE_WEBHOOK_SECRET! ); } catch (err) { return new NextResponse(“Invalid signature”, { status: 400 }); } if (event.type === “checkout.session.completed”) { const session = event.data.object as Stripe.Checkout.Session; // Fulfill the order here: mark paid, send the product, email receipt console.log(“Payment confirmed:”, session.id); } return NextResponse.json({ received: true }); } Two things catch almost everyone here. First, you must read the raw request body with req.text(), not parsed JSON, because Stripe verifies a signature against the exact raw bytes. Second, always return a 200 response, even for events you do not handle, otherwise Stripe retries for up to 72 hours. Verifying the signature is what proves the message genuinely came from Stripe and not an attacker. Step 5: Test locally with the Stripe CLI You cannot test webhooks just by clicking around, you need Stripe to reach your local server. The Stripe CLI does this. Install it, log in, then forward events to your app: stripe listen --forward-to localhost:3000/api/webhooks/stripe This prints a webhook signing secret (starting whsec_), put that in your STRIPE_WEBHOOK_SECRET. Now run a test payment through your checkout button using Stripe’s test card number, 4242 4242 4242 4242 with any future expiry and any CVC, and watch the CLI forward the checkout.session.completed event to your webhook. When your webhook logs the confirmation, the full loop works. Step 6: Go live Switching to real payments is a short checklist. Replace your test API keys with your live keys (from the Stripe Dashboard, after activating your account). In the Stripe Dashboard, under Developers then Webhooks, add your production webhook endpoint, https://your-domain.com/api/webhooks/stripe , and copy its signing secret into your production environment variables. Deploy, and run one real, small transaction to confirm the live flow end to end. On Vercel or similar, add all your environment variables in the project settings. That is it: real payments flowing, confirmed by webhook, with card security handled entirely by Stripe. The mistakes that break Stripe integrations A few errors catch almost everyone. Avoid these. Trusting the browser instead of the webhook. If you mark an order paid based on the user landing on your success page, you will lose orders and let people fake payments. The webhook is the only source of truth. This is the single most important rule. Parsing the webhook body as JSON. Reading the body any way other than raw text breaks signature verification. Use req.text(). Exposing the secret key. The secret key must stay server-side only. Never prefix it with NEXT_PUBLIC_ or use it in a client component. Not returning 200 from the webhook. If your handler errors or returns a non-200, Stripe retries for up to 72 hours. Handle events, then return 200. Forgetting the production webhook. Local testing uses the CLI; production needs a webhook endpoint registered in the Stripe Dashboard with its own signing secret. Forgetting this means payments work but orders never get fulfilled live. Ready to add payments to your app? Adding Stripe to a Next.js app is genuinely approachable: hosted Checkout handles the hard, sensitive parts, and a correct webhook makes it reliable. Get those two right, and you have production-grade payments without ever touching raw card data. When you want payments built properly, including subscriptions , multiple gateways, or complex billing, as part of a real product, the Craxinno team integrates Stripe and other payment gateways into Next.js and mobile apps. See recent work in the Craxinno portfolio, explore our custom software development service , or email sales@craxinno.com .
© 2026 — Craxinno Technologies
