GenAI App Development & Backend Integration
Google AI Studio + Firebase: prototype prompts, build an app, connect a secure backend.
Audience
Front-end, back-end and full-stack developers. No prior AI Studio experience required; basic JavaScript, terminal and web concepts assumed.
One project
Connected Event App: sign-in, saved registration and an AI event helper. Firebase Hosting serves the frontend; Cloud Functions calls Gemini.
What is Google AI Studio?
A workspace for trying Gemini and turning an idea into a prototype.
Explore a model
Write a prompt, run it, inspect the response, and refine the request. Available models and settings depend on your account.
Explore Build mode
Describe a small app, inspect its preview, and request specific changes. You will learn these controls with an everyday example before examining developer integration.
Find your starting point.
No previous AI Studio experience is assumed.
- Have you used AI Studio or only a chat application? Record your starting point in learning-checks.md.
- Try identifying where to choose a model, enter a prompt, and run it.
- Name an everyday task where you would like a useful AI-generated result.
From a tested prompt to a connected app.
Learn the tool before applying developer integration patterns.
- Write system instructions, add few-shot examples, compare results and manage a Gemini API key.
- Build and test a frontend, then connect Firebase Authentication and Firestore.
- Call Gemini through an authenticated Cloud Function, deploy to Firebase Hosting, and verify five core checks.
- Explain quotas, missing-information handling and ownership rules; demonstrate the app.
One app throughout the day.
The project grows through the labs; the final sprint completes existing work.
| Time | Activity | Evidence |
|---|---|---|
| 9:00–9:30 | AI Studio purpose and workspace | First prompt |
| 9:30–10:30 | Instructions, few-shot examples, settings, keys | Compared prompts |
| 10:30–10:45 | Break | |
| 10:45–12:00 | Build and export a static frontend | Working local page |
| 12:00–1:00 | Firebase setup, Auth and Firestore | Sign in, save, reload |
| 1:00–2:00 | Lunch | |
| 2:00–2:25 | Serverless Gemini integration | Callable function |
| 2:25–3:00 | Firebase deployment and reliability | Hosted workflow |
| 3:00–3:15 | Break | |
| 3:15–3:25 | Project acceptance brief | Five checks |
| 3:25–4:15 | Fix, verify and rehearse | Evidence and handoff |
| 4:15–4:55 | Five presentations | 5 minutes + 3 minutes Q&A |
| 4:55–5:00 | Exit check | Individual reflection |
Check access before building.
Use the trainer-prepared project details and fictional data.
- Open the provided project setup card: AI Studio, Firebase project ID, and approved Firebase project.
- Confirm Google sign-in, Firestore, and deployment permissions have been checked by the trainer. Cloud Functions deployment needs a billing-enabled Firebase project.
- If setup is blocked, join a prepared team project or use the trainer baseline; record what you could test.
Open AI Studio and run your first prompt.
Use the fictional event pack; Day 1 attendance is not required.
- Open Google AI Studio. Check prompt and Build access.
- Download the exercise pack. Open ai-studio-starter.md and morning-starter/01-current-guide.md.
- Choose an available text model with trainer guidance. Record its name and keep default settings initially.
- Run a simple request: “Write a friendly two-sentence welcome for a community learning event.” Inspect the output.
Know which part of the workspace you are using.
Prompt experimentation and app building are related but different activities.
| Area | Purpose | Find it |
|---|---|---|
| Prompt workspace | Try a request and inspect a model response. | Prompt input, Run, and response area. |
| Model / run settings | Select a model and inspect available controls. | Current model and supported settings. |
| Instructions / context | Define how the assistant should respond and what material it should use. | Instruction field where available, or labelled sections in your prompt. |
| Build mode | Generate and refine a small app. | App brief, preview, and generated code area. |
Tell the tool what a useful answer looks like.
A prompt is a request; instructions define the behaviour you want it to follow.
Specify the task
State the audience, task, and output format. For example: a three-bullet arrival checklist for a first-time attendee.
Supply the facts
Include the event guide when you want an answer about that event. Without it, the model does not know the actual room or registration time.
Task: Write a three-bullet arrival checklist for a first-time attendee. Use only the reference below for event facts. If information is missing, say so. Reference: [Paste START-01 from the morning starter pack.]
Worked example / Replace guessing with a clear request.
Compare what you asked for with what the model actually returned.
| Version | Request | What to inspect |
|---|---|---|
| Vague | Tell me about this event. | Missing context and unspecified output. |
| Specific | Using START-01, list arrival time, room, and what to bring in three bullets. | Expected facts: 10:00, Room B, notebook and water bottle. |
| Follow-up | Keep the same facts, but make it a concise checklist. | The format changes; the source facts should not. |
A response is polished but changes the room. Is the prompt successful?
No. Check factual correctness as well as tone and format. Record what actually happened.
Change one thing at a time.
Settings are controls to investigate, not shortcuts to correctness.
- Locate the chosen model and available run settings. Record the defaults.
- Change one supported control with trainer guidance—for example an output-length limit where available. Predict what you expect to change.
- Run the same prompt and compare. Restore the default after the experiment.
- For prompt-version comparisons, keep model, settings, and source text unchanged.
Few-shot prompting: show the pattern.
Examples demonstrate the kind of response you want; they do not train new model weights.
System instruction: You help event participants. Use only the current event reference. Keep answers short. Say when a detail is not documented. Example question: When does registration open? Example answer: Registration opens at 10:00 in Room B. Example question: Is there a shuttle? Example answer: A shuttle service is not documented in the supplied reference. Now answer: What should I bring?
An API key connects code to Gemini.
Create or select a currently supported key in AI Studio’s API Keys area using your workshop project.
- Confirm the selected project and current key requirements with the trainer.
- Test using the trainer’s server environment; do not paste the value into slides, worksheets or browser code.
- Later store it as a Cloud Functions secret and bind it only to the function that needs it.
Practice 01 / Refine and compare.
10 minutes explanation/example · 35 minutes practice · 15 minutes feedback.
- Create a basic event-helper prompt using START-01 and START-02.
- Create a second version with explicit audience, output format, and unknown-answer instructions.
- Run the same three event questions for both versions: registration, what to bring, and parking fee. Record six actual responses.
- Explain which version helps and which issues remain. Save or copy your prompts and settings to the worksheet.
Take fifteen.
10:30–10:45 am
Build the frontend before connecting services.
Use AI Studio to generate a small app, then inspect and test the code.
Create a static vanilla HTML/CSS/JavaScript Community Learning Day frontend. Include programme, nickname, morning/afternoon choice and an event Q&A panel. Show validation, loading, success and error states. Start with labelled mock data. Prepare ES modules for Firebase Auth, Firestore and an httpsCallable askEvent function. No Node server, SSR or browser Gemini key. Provide static files that can be served by Firebase Hosting.
Describe → preview → change → check.
Learn the Build workflow through one visible improvement.
- Locate the brief input, preview, and generated-code area.
- Try the form and Q&A controls. Compare event details with the source guide.
- Request one specific change, such as clearer validation for an empty nickname.
- Open the updated preview and verify the change; retain the working version.
Practice / A useful event page.
15 minutes demonstration · 40 minutes building · 20 minutes review.
- Use the supplied brief and event facts.
- Test the visible controls and empty input.
- Make and verify one improvement.
- Export the static files and record your project link and reference/prompt. Confirm the exported page works before connecting services.
What does Firebase add?
Sign-in identifies the person; storage remembers their registration.
Authentication
Firebase Authentication signs the user in and provides a stable user ID. The interface can show whether a user is signed in.
Cloud Firestore
Firestore stores a document so the registration can still be read after refresh. Rules control what browser clients may read and write.
Connect Google sign-in to the same app.
Before this lab, confirm the trainer has checked the Firebase project and authorised domains.
Extend this existing event app with Firebase Google sign-in using the trainer-approved Firebase project. Show Daftar masuk, Daftar keluar, and the current sign-in state. Use the actual Firebase SDK, not a simulated identity. Do not create a different project without checking the supplied project ID. Keep registration unavailable when signed out.
- Use AI Studio’s Firebase integration when available, or the prepared configuration path.
- In Firebase Authentication, confirm the Google provider and required project settings with the trainer.
- Sign in and out. Check the user in Authentication and note the UID.
Save, refresh, and retrieve your registration.
A success message alone does not prove data was stored.
Use Firestore client reads/writes at users/{uid}/registrations/community-learning-day. Save only nickname and sessionChoice. Use the supplied owner-only firestore.rules and validate the allowed fields. Read this document after sign-in and refresh. Repeated submission updates the same document. Show Simpan pendaftaran, saved, loading, and error states. Never display saved before a successful write.- Apply/review the supplied rules in the prepared training project.
- Save a fictional registration and inspect the exact document path.
- Refresh the app and read the same values. Check signed-out and other-user access is denied.
Practice / Connect identity and storage.
15 minutes demonstration · 30 minutes guided connection · 15 minutes verification.
- Verify the project ID, sign-in provider, and rules with the trainer.
- Sign in and save a fictional nickname/session choice.
- Refresh and compare the loaded result with Firestore. Add an onSnapshot listener, observe an update in a second signed-in tab, and unsubscribe on sign-out.
- Use the prepared second test account to check that another user cannot read or change your document.
Your app now remembers a registration.
1:00–2:00 pm
Cloud Functions: your server-side AI boundary.
A callable function runs backend code without exposing the Gemini credential to the browser.
- Create askEvent with the Firebase Functions callable API. The callable protocol validates provided Firebase tokens; explicitly reject a missing request.auth.
- Validate the question length and content. Supply only approved event facts; never attach registration records.
- Read the Gemini key from a bound secret. Make a real Gemini request and return a small answer object.
- The browser calls httpsCallable and displays loading, answer, error and retry states.
Follow the two request paths.
Hosting, identity, storage and AI have distinct jobs.
Page and registration
Firebase Hosting → browser. Browser signs in with Firebase Auth and reads/writes its own Firestore record under rules.
AI question
Browser → callable Cloud Function → Gemini → function → browser. The function checks the authenticated user and keeps its secret server-side.
Lab: connect and inspect a real AI response.
Use the same app and current event reference.
- Deploy or run the prepared callable function and connect the client to the matching function region.
- Sign in, ask registration time, then ask parking fees. Check the first answer and the unknown response.
- Sign out and call the function: it must reject the request.
- Inspect source and browser traffic: no Gemini key is delivered to the browser.
Firebase Hosting serves your web app.
Deploy the static frontend separately from the callable backend.
Hosting
Serves HTML, CSS and JavaScript over HTTPS at the project’s Hosting URL.
Cloud Functions
Runs askEvent on the server. The Firebase client SDK calls it using the callable protocol; an HTTP rewrite is not required.
Deploy and repeat the full workflow.
Follow the integration guide with the trainer-prepared project.
- Check .firebaserc points to the workshop project; configure firebase.json for public files, functions and Firestore rules.
- Set the Gemini secret, then deploy the function, rules and Hosting using the Firebase CLI.
- Check the Hosting hostname in Firebase Authentication authorised domains.
- Open the returned Hosting URL; sign in, save, refresh and call the AI helper.
Plan for limits and imperfect answers.
A small app still needs clear failure behaviour.
- Handle quota/rate-limit errors with a helpful message and bounded retry/backoff; prevent duplicate submissions while waiting.
- Set conservative output/input limits and function scaling limits with the trainer; monitor usage and logs. maxInstances is not a per-user rate limiter or a hard spending cap.
- Use reference-based answers, unknown responses and a test set to reduce unsupported claims.
- Apply owner-only database rules. Discuss App Check and server-side per-user rate limits as next steps before wider release.
Alternative: deploy the server app to Cloud Run.
Choose this route when retaining an AI Studio-generated server app instead of the static Hosting/callable architecture.
- AI Studio can deploy its app to Cloud Run; confirm project, billing and permissions.
- Configure server secrets and validate Firebase ID tokens in your own server endpoints.
- Keep Firebase Auth and Firestore if needed, then test the deployed domain and ownership controls.
Practice / Confirm the hosted workflow.
10 minutes demonstration · 20 minutes deployment/checks · 5 minutes feedback.
- Open the deployed URL in a fresh browser context and sign in.
- Confirm the app uses the intended Firebase project and own-user registration.
- Run one documented and one unsupported event question.
- Record actual results. If access or billing blocks deployment, use the trainer baseline and mark your own deployment incomplete.
Take a short break.
3:00–3:15 pm
Project / Connected Event App.
Finish one understood workflow rather than adding more features.
- Complete Google sign-in and an owner-scoped saved registration.
- Keep the AI helper grounded in the current event information.
- Deploy to Firebase Hosting and run the five core checks.
- Record a fix/retest and prepare a five-minute demonstration.
Five required checks.
Record each result as pass, fail, or not run.
| Check | Evidence required |
|---|---|
| C01 · Sign-in | Real user session; signed-out registration and callable requests are blocked. |
| C02 · Save and ownership | Own record persists after refresh and updates in a second signed-in tab; unauthenticated/other-user access denied. |
| C03 · AI answers | Real call answers a documented question and acknowledges an undocumented fee. |
| C04 · Failure handling | Empty input and a labelled simulated quota/service failure show clear recovery and retry states. |
| C05 · Deployment | Firebase Hosting URL supports sign-in, persistence and a real callable AI response; Gemini key is absent from client code/traffic. |
Complete, verify, and rehearse.
No new app, no extra feature list.
| Time | Action |
|---|---|
| 3:25–3:40 | Finish any missing connection or deployment step. |
| 3:40–4:00 | Run five checks, fix one failure, and retest. |
| 4:00–4:10 | Save URL, evidence, and short handoff notes. |
| 4:10–4:15 | Rehearse the five-minute demonstration. |
Demonstrate the whole workflow.
Five minutes to show it; three minutes for questions.
| Time | Show |
|---|---|
| 0:00–0:45 | Purpose and the app you built. |
| 0:45–2:15 | Open the deployed URL, sign in, save and reload registration. |
| 2:15–3:30 | A real AI answer and an unsupported question. |
| 3:30–4:30 | One check/fix and where the data and secret live. |
| 4:30–5:00 | Handoff and one remaining limitation. |
How your connected app will be assessed.
Useful behaviour and honest evaluation carry more weight than visual polish.
| Criterion | Weight | What strong work looks like |
|---|---|---|
| Correctness & evidence | 35% | Claims match sources; uncertainty is explicit. |
| Completeness & usefulness | 30% | Required outputs are usable by another developer. |
| Verification & limitations | 20% | Checks are recorded; failures and gaps are explained. |
| Presentation & explanation | 15% | A clear live demonstration within five minutes. |
Explain what you connected.
A working group app does not replace individual understanding.
- Complete the four Day 2 exit questions in learning-checks.md.
- Identify what AI Studio, Authentication, Firestore, Hosting, Cloud Functions, and Gemini each do.
- Name a real task where you could repeat this workflow.
Hand over the app and its evidence.
Use the trainer’s agreed submission location.
- Submit the Firebase Hosting URL and source export (including callable function) or repository link.
- Include the Firebase/Cloud project identifiers, five-check report, and a brief explanation of the data/request flow.
- List any failed/not-run check and the next action. Never include secret values.
Keep the working guides nearby.
Official references and workshop materials.
