CloudspaceDAY 02 / GOOGLE AI STUDIO
Built for the workshop.Use ← → to move between slides. Choose a slide from the learning path above.

Download exercise pack ↓
Session 02 / Learn · try · check
9:00–9:30

GenAI App Development & Backend Integration

Google AI Studio + Firebase: prototype prompts, build an app, connect a secure backend.

Audience

Front-end, back-end and full-stack developers. No prior AI Studio experience required; basic JavaScript, terminal and web concepts assumed.

One project

Connected Event App: sign-in, saved registration and an AI event helper. Firebase Hosting serves the frontend; Cloud Functions calls Gemini.

15–20 participants · 9:00–5:00, eight elapsed hours including breaks and lunch · Five teams of 3–4 · Cloud Run is an alternative deployment path.
Day 02 / Tool essentials
9:00–9:30

What is Google AI Studio?

A workspace for trying Gemini and turning an idea into a prototype.

Explore a model

Write a prompt, run it, inspect the response, and refine the request. Available models and settings depend on your account.

Explore Build mode

Describe a small app, inspect its preview, and request specific changes. You will learn these controls with an everyday example before examining developer integration.

Morning: Community Learning Day prompts and a simple event page. After lunch: add an AI event helper and deploy the same app to Firebase Hosting.
Day 02 / Starting point
9:00–9:30

Find your starting point.

No previous AI Studio experience is assumed.

  1. Have you used AI Studio or only a chat application? Record your starting point in learning-checks.md.
  2. Try identifying where to choose a model, enter a prompt, and run it.
  3. Name an everyday task where you would like a useful AI-generated result.
Done when: The trainer knows which tool operations need a walkthrough.
Session 02 / Learn · try · check
9:00–9:30

From a tested prompt to a connected app.

Learn the tool before applying developer integration patterns.

  1. Write system instructions, add few-shot examples, compare results and manage a Gemini API key.
  2. Build and test a frontend, then connect Firebase Authentication and Firestore.
  3. Call Gemini through an authenticated Cloud Function, deploy to Firebase Hosting, and verify five core checks.
  4. Explain quotas, missing-information handling and ownership rules; demonstrate the app.
Session 02 / Learn · try · check
9:00–5:00

One app throughout the day.

The project grows through the labs; the final sprint completes existing work.

TimeActivityEvidence
9:00–9:30AI Studio purpose and workspaceFirst prompt
9:30–10:30Instructions, few-shot examples, settings, keysCompared prompts
10:30–10:45Break
10:45–12:00Build and export a static frontendWorking local page
12:00–1:00Firebase setup, Auth and FirestoreSign in, save, reload
1:00–2:00Lunch
2:00–2:25Serverless Gemini integrationCallable function
2:25–3:00Firebase deployment and reliabilityHosted workflow
3:00–3:15Break
3:15–3:25Project acceptance briefFive checks
3:25–4:15Fix, verify and rehearseEvidence and handoff
4:15–4:55Five presentations5 minutes + 3 minutes Q&A
4:55–5:00Exit checkIndividual reflection
Day 02 / Learn → try → check
9:00–9:30

Check access before building.

Use the trainer-prepared project details and fictional data.

  1. Open the provided project setup card: AI Studio, Firebase project ID, and approved Firebase project.
  2. Confirm Google sign-in, Firestore, and deployment permissions have been checked by the trainer. Cloud Functions deployment needs a billing-enabled Firebase project.
  3. If setup is blocked, join a prepared team project or use the trainer baseline; record what you could test.
Checkpoint: You have a usable project route. A setup blocker is not counted as a successful deployment.
Open setup checklist →
Day 02 / First hands-on task
9:00–9:30

Open AI Studio and run your first prompt.

Use the fictional event pack; Day 1 attendance is not required.

  1. Open Google AI Studio. Check prompt and Build access.
  2. Download the exercise pack. Open ai-studio-starter.md and morning-starter/01-current-guide.md.
  3. Choose an available text model with trainer guidance. Record its name and keep default settings initially.
  4. Run a simple request: “Write a friendly two-sentence welcome for a community learning event.” Inspect the output.
Done when: You can run a prompt and locate its response. Pair up if access is blocked.
Day 02 / Tool essentials
9:00–9:30

Know which part of the workspace you are using.

Prompt experimentation and app building are related but different activities.

AreaPurposeFind it
Prompt workspaceTry a request and inspect a model response.Prompt input, Run, and response area.
Model / run settingsSelect a model and inspect available controls.Current model and supported settings.
Instructions / contextDefine how the assistant should respond and what material it should use.Instruction field where available, or labelled sections in your prompt.
Build modeGenerate and refine a small app.App brief, preview, and generated code area.
Use the interface available to your account. Feature names and controls can vary; no one needs to memorise screenshots.
How do I experiment in AI Studio?
Day 02 / Tool essentials
9:30–10:30

Tell the tool what a useful answer looks like.

A prompt is a request; instructions define the behaviour you want it to follow.

Specify the task

State the audience, task, and output format. For example: a three-bullet arrival checklist for a first-time attendee.

Supply the facts

Include the event guide when you want an answer about that event. Without it, the model does not know the actual room or registration time.

Try this prompt
Task: Write a three-bullet arrival checklist for a first-time attendee.
Use only the reference below for event facts. If information is missing, say so.
Reference:
[Paste START-01 from the morning starter pack.]
Day 02 / Worked example
9:30–10:30

Worked example / Replace guessing with a clear request.

Compare what you asked for with what the model actually returned.

VersionRequestWhat to inspect
VagueTell me about this event.Missing context and unspecified output.
SpecificUsing START-01, list arrival time, room, and what to bring in three bullets.Expected facts: 10:00, Room B, notebook and water bottle.
Follow-upKeep the same facts, but make it a concise checklist.The format changes; the source facts should not.
A response is polished but changes the room. Is the prompt successful?

No. Check factual correctness as well as tone and format. Record what actually happened.

Day 02 / Tool essentials
9:30–10:30

Change one thing at a time.

Settings are controls to investigate, not shortcuts to correctness.

  1. Locate the chosen model and available run settings. Record the defaults.
  2. Change one supported control with trainer guidance—for example an output-length limit where available. Predict what you expect to change.
  3. Run the same prompt and compare. Restore the default after the experiment.
  4. For prompt-version comparisons, keep model, settings, and source text unchanged.
Done when: You can name the setting you changed and describe the observed effect, including no visible effect.
Controls differ by model. A low temperature does not guarantee truth or identical answers. Do not switch models and rewrite the prompt at the same time when comparing results.
How can I tell whether a prompt change actually helped?
Session 02 / Learn · try · check
9:30–10:30

Few-shot prompting: show the pattern.

Examples demonstrate the kind of response you want; they do not train new model weights.

Try this prompt
System instruction: You help event participants. Use only the current event reference. Keep answers short. Say when a detail is not documented.
Example question: When does registration open?
Example answer: Registration opens at 10:00 in Room B.
Example question: Is there a shuttle?
Example answer: A shuttle service is not documented in the supplied reference.
Now answer: What should I bring?
Exercise: compare the same new question with and without these examples. Keep reference, model and settings fixed. Prompt/settings refinement is the scope; model fine-tuning is not.
Session 02 / Learn · try · check
9:30–10:30

An API key connects code to Gemini.

Create or select a currently supported key in AI Studio’s API Keys area using your workshop project.

  1. Confirm the selected project and current key requirements with the trainer.
  2. Test using the trainer’s server environment; do not paste the value into slides, worksheets or browser code.
  3. Later store it as a Cloud Functions secret and bind it only to the function that needs it.
Firebase web configuration identifies your app. The Gemini key is a server credential. An AI Studio preview secret does not automatically configure an exported Firebase project.
Day 02 / Guided practice
9:30–10:30

Practice 01 / Refine and compare.

10 minutes explanation/example · 35 minutes practice · 15 minutes feedback.

  1. Create a basic event-helper prompt using START-01 and START-02.
  2. Create a second version with explicit audience, output format, and unknown-answer instructions.
  3. Run the same three event questions for both versions: registration, what to bring, and parking fee. Record six actual responses.
  4. Explain which version helps and which issues remain. Save or copy your prompts and settings to the worksheet.
Done when: Your comparison includes actual results, not just a claim that the longer prompt is better.
Day 02 / Break
10:30–10:45

Take fifteen.

10:30–10:45 am

Next, turn the event facts and prompt practice into one app.
Session 02 / Learn · try · check
10:45–12:00

Build the frontend before connecting services.

Use AI Studio to generate a small app, then inspect and test the code.

Try this prompt
Create a static vanilla HTML/CSS/JavaScript Community Learning Day frontend. Include programme, nickname, morning/afternoon choice and an event Q&A panel. Show validation, loading, success and error states. Start with labelled mock data. Prepare ES modules for Firebase Auth, Firestore and an httpsCallable askEvent function. No Node server, SSR or browser Gemini key. Provide static files that can be served by Firebase Hosting.
Export/download the generated source. Inspect it: a server-based or bundled output must be adapted to the supplied static baseline with trainer help before Hosting.
How does an idea become a working page?
Day 02 / Learn → try → check
10:45–12:00

Describe → preview → change → check.

Learn the Build workflow through one visible improvement.

  1. Locate the brief input, preview, and generated-code area.
  2. Try the form and Q&A controls. Compare event details with the source guide.
  3. Request one specific change, such as clearer validation for an empty nickname.
  4. Open the updated preview and verify the change; retain the working version.
Checkpoint: You can explain the change and demonstrate it. No new app is started for the next module.
Day 02 / Guided practice
10:45–12:00

Practice / A useful event page.

15 minutes demonstration · 40 minutes building · 20 minutes review.

  1. Use the supplied brief and event facts.
  2. Test the visible controls and empty input.
  3. Make and verify one improvement.
  4. Export the static files and record your project link and reference/prompt. Confirm the exported page works before connecting services.
Checkpoint: You have a working starting point ready for sign-in and storage.
Day 02 / Learn → try → check
12:00–1:00

What does Firebase add?

Sign-in identifies the person; storage remembers their registration.

Authentication

Firebase Authentication signs the user in and provides a stable user ID. The interface can show whether a user is signed in.

Cloud Firestore

Firestore stores a document so the registration can still be read after refresh. Rules control what browser clients may read and write.

For this course: one event, one registration per user. Use the Firebase browser SDK with owner-only rules. Registration data is not sent to the AI helper.
How does the app remember my registration?
Day 02 / Learn → try → check
12:00–1:00

Connect Google sign-in to the same app.

Before this lab, confirm the trainer has checked the Firebase project and authorised domains.

Copy into AI Studio
Extend this existing event app with Firebase Google sign-in using the trainer-approved Firebase project. Show Daftar masuk, Daftar keluar, and the current sign-in state. Use the actual Firebase SDK, not a simulated identity. Do not create a different project without checking the supplied project ID. Keep registration unavailable when signed out.
  1. Use AI Studio’s Firebase integration when available, or the prepared configuration path.
  2. In Firebase Authentication, confirm the Google provider and required project settings with the trainer.
  3. Sign in and out. Check the user in Authentication and note the UID.
Checkpoint: Sign-in is real and the UI follows its state.
Day 02 / Learn → try → check
12:00–1:00

Save, refresh, and retrieve your registration.

A success message alone does not prove data was stored.

Copy into AI Studio
Use Firestore client reads/writes at users/{uid}/registrations/community-learning-day. Save only nickname and sessionChoice. Use the supplied owner-only firestore.rules and validate the allowed fields. Read this document after sign-in and refresh. Repeated submission updates the same document. Show Simpan pendaftaran, saved, loading, and error states. Never display saved before a successful write.
  1. Apply/review the supplied rules in the prepared training project.
  2. Save a fictional registration and inspect the exact document path.
  3. Refresh the app and read the same values. Check signed-out and other-user access is denied.
Checkpoint: Checkpoint 2: real sign-in. Checkpoint 3: one persistent, owner-scoped registration.
If generated code uses a server/Admin SDK instead, these client rules do not protect that path. Use the prepared client-SDK baseline or have the trainer implement and verify server authorisation.
Day 02 / Learn → try → check
12:00–1:00

Practice / Connect identity and storage.

15 minutes demonstration · 30 minutes guided connection · 15 minutes verification.

  1. Verify the project ID, sign-in provider, and rules with the trainer.
  2. Sign in and save a fictional nickname/session choice.
  3. Refresh and compare the loaded result with Firestore. Add an onSnapshot listener, observe an update in a second signed-in tab, and unsubscribe on sign-out.
  4. Use the prepared second test account to check that another user cannot read or change your document.
Checkpoint: The record persists and belongs to its user; a failed check is recorded for repair.
Day 02 / Break
1:00–2:00

Your app now remembers a registration.

1:00–2:00 pm

Keep the same project. After lunch, add one AI feature and deploy it.
Session 02 / Learn · try · check
2:00–2:25

Cloud Functions: your server-side AI boundary.

A callable function runs backend code without exposing the Gemini credential to the browser.

  1. Create askEvent with the Firebase Functions callable API. The callable protocol validates provided Firebase tokens; explicitly reject a missing request.auth.
  2. Validate the question length and content. Supply only approved event facts; never attach registration records.
  3. Read the Gemini key from a bound secret. Make a real Gemini request and return a small answer object.
  4. The browser calls httpsCallable and displays loading, answer, error and retry states.
Use materials/firebase-integration-guide.md. Authentication does not replace authorization or input validation.
Session 02 / Learn · try · check
2:00–2:25

Follow the two request paths.

Hosting, identity, storage and AI have distinct jobs.

Page and registration

Firebase Hosting → browser. Browser signs in with Firebase Auth and reads/writes its own Firestore record under rules.

AI question

Browser → callable Cloud Function → Gemini → function → browser. The function checks the authenticated user and keeps its secret server-side.

Server/Admin SDK Firestore access bypasses client security rules; server code must enforce its own authorization. This lab keeps registration access in the client SDK.
Where does the AI request actually run?
Session 02 / Learn · try · check
2:00–2:25

Lab: connect and inspect a real AI response.

Use the same app and current event reference.

  1. Deploy or run the prepared callable function and connect the client to the matching function region.
  2. Sign in, ask registration time, then ask parking fees. Check the first answer and the unknown response.
  3. Sign out and call the function: it must reject the request.
  4. Inspect source and browser traffic: no Gemini key is delivered to the browser.
The trainer provides a rehearsed backend baseline. Record a mocked response as simulated, not as a completed integration.
Session 02 / Learn · try · check
2:25–3:00

Firebase Hosting serves your web app.

Deploy the static frontend separately from the callable backend.

Hosting

Serves HTML, CSS and JavaScript over HTTPS at the project’s Hosting URL.

Cloud Functions

Runs askEvent on the server. The Firebase client SDK calls it using the callable protocol; an HTTP rewrite is not required.

What does publishing this app actually involve?
Session 02 / Learn · try · check
2:25–3:00

Deploy and repeat the full workflow.

Follow the integration guide with the trainer-prepared project.

  1. Check .firebaserc points to the workshop project; configure firebase.json for public files, functions and Firestore rules.
  2. Set the Gemini secret, then deploy the function, rules and Hosting using the Firebase CLI.
  3. Check the Hosting hostname in Firebase Authentication authorised domains.
  4. Open the returned Hosting URL; sign in, save, refresh and call the AI helper.
Cloud Functions deployment needs a billing-enabled Firebase project and appropriate permissions. No cloud resource is provisioned by these course files.
Session 02 / Learn · try · check
2:25–3:00

Plan for limits and imperfect answers.

A small app still needs clear failure behaviour.

  1. Handle quota/rate-limit errors with a helpful message and bounded retry/backoff; prevent duplicate submissions while waiting.
  2. Set conservative output/input limits and function scaling limits with the trainer; monitor usage and logs. maxInstances is not a per-user rate limiter or a hard spending cap.
  3. Use reference-based answers, unknown responses and a test set to reduce unsupported claims.
  4. Apply owner-only database rules. Discuss App Check and server-side per-user rate limits as next steps before wider release.
Exercise: trigger a labelled simulated quota failure, recover, and repeat a real request. Never log secret values or unnecessary personal data.
Session 02 / Learn · try · check
Optional reference

Alternative: deploy the server app to Cloud Run.

Choose this route when retaining an AI Studio-generated server app instead of the static Hosting/callable architecture.

  1. AI Studio can deploy its app to Cloud Run; confirm project, billing and permissions.
  2. Configure server secrets and validate Firebase ID tokens in your own server endpoints.
  3. Keep Firebase Auth and Firestore if needed, then test the deployed domain and ownership controls.
Architecture comparison only in the core schedule. A second deployment is optional; the required project uses Firebase Hosting + Cloud Functions.
Day 02 / Learn → try → check
2:25–3:00

Practice / Confirm the hosted workflow.

10 minutes demonstration · 20 minutes deployment/checks · 5 minutes feedback.

  1. Open the deployed URL in a fresh browser context and sign in.
  2. Confirm the app uses the intended Firebase project and own-user registration.
  3. Run one documented and one unsupported event question.
  4. Record actual results. If access or billing blocks deployment, use the trainer baseline and mark your own deployment incomplete.
Checkpoint: You have a real URL and evidence, or a clearly documented blocker—never a pretend deployment.
Day 02 / Break
3:00–3:15

Take a short break.

3:00–3:15 pm

The project completes and verifies the same app you have been building.
Day 02 / Learn → try → check
3:15–3:25

Project / Connected Event App.

Finish one understood workflow rather than adding more features.

  1. Complete Google sign-in and an owner-scoped saved registration.
  2. Keep the AI helper grounded in the current event information.
  3. Deploy to Firebase Hosting and run the five core checks.
  4. Record a fix/retest and prepare a five-minute demonstration.
Checkpoint: Submit the deployed URL, source/export or project link, and five-check evidence. Advanced cases are optional.
Day 02 / Learn → try → check
3:15–3:25

Five required checks.

Record each result as pass, fail, or not run.

CheckEvidence required
C01 · Sign-inReal user session; signed-out registration and callable requests are blocked.
C02 · Save and ownershipOwn record persists after refresh and updates in a second signed-in tab; unauthenticated/other-user access denied.
C03 · AI answersReal call answers a documented question and acknowledges an undocumented fee.
C04 · Failure handlingEmpty input and a labelled simulated quota/service failure show clear recovery and retry states.
C05 · DeploymentFirebase Hosting URL supports sign-in, persistence and a real callable AI response; Gemini key is absent from client code/traffic.
Five checks can each include several observations. They are a small workshop acceptance set, not a complete production security review.
Day 02 / Learn → try → check
3:25–4:15

Complete, verify, and rehearse.

No new app, no extra feature list.

TimeAction
3:25–3:40Finish any missing connection or deployment step.
3:40–4:00Run five checks, fix one failure, and retest.
4:00–4:10Save URL, evidence, and short handoff notes.
4:10–4:15Rehearse the five-minute demonstration.
If all checks pass, explain the whole request/data flow or try one optional edge case.
Day 02 / Learn → try → check
4:15–4:55

Demonstrate the whole workflow.

Five minutes to show it; three minutes for questions.

TimeShow
0:00–0:45Purpose and the app you built.
0:45–2:15Open the deployed URL, sign in, save and reload registration.
2:15–3:30A real AI answer and an unsupported question.
3:30–4:30One check/fix and where the data and secret live.
4:30–5:00Handoff and one remaining limitation.
Five teams fit the 40-minute slot. Larger cohorts need parallel review or adjusted presentation scheduling.
Day 02 / Assessment
4:15–4:55

How your connected app will be assessed.

Useful behaviour and honest evaluation carry more weight than visual polish.

CriterionWeightWhat strong work looks like
Correctness & evidence35%Claims match sources; uncertainty is explicit.
Completeness & usefulness30%Required outputs are usable by another developer.
Verification & limitations20%Checks are recorded; failures and gaps are explained.
Presentation & explanation15%A clear live demonstration within five minutes.
Day 02 / Learn → try → check
4:55–5:00

Explain what you connected.

A working group app does not replace individual understanding.

  1. Complete the four Day 2 exit questions in learning-checks.md.
  2. Identify what AI Studio, Authentication, Firestore, Hosting, Cloud Functions, and Gemini each do.
  3. Name a real task where you could repeat this workflow.
Checkpoint: Record your answer, feedback, and any concept to revisit.
Day 02 / Learn → try → check
4:55–5:00

Hand over the app and its evidence.

Use the trainer’s agreed submission location.

  1. Submit the Firebase Hosting URL and source export (including callable function) or repository link.
  2. Include the Firebase/Cloud project identifiers, five-check report, and a brief explanation of the data/request flow.
  3. List any failed/not-run check and the next action. Never include secret values.
Checkpoint: The handoff says what works, how it was checked, and what remains.
Programme overview →
Day 02 / Resources
Reference

Keep the working guides nearby.

Official references and workshop materials.