Architectural Adaptations of the Client-Server Model for Calling External AI Tools via API Key

Abstract

The consolidation of Large Language Models (LLMs) as active components in software development has exposed critical limitations in the traditional two-tier client-server architecture, which was not designed to manage programmatic credentials of high sensitivity, orchestrate concurrent calls to heterogeneous external tools, or guarantee resilience against third-party service unavailability. This paper presents an exploratory study aimed at identifying and characterizing the architectural adaptations required in the client-server model to support authenticated calls to external AI tools via API keys, in the context of intelligent application development. A non-systematic literature review was conducted on peer-reviewed sources from IEEE Xplore, ACM Digital Library, arXiv, and ScienceDirect (2021–2026), extracting data along five analytical dimensions: communication protocol, authentication mechanism, tool-calling paradigm, security management strategy, and affected architectural layer. The results indicate that the transition toward an N-tier architecture with a centralized API Gateway is a fundamental structural adaptation, not an incremental option. Three evolutionary levels of authentication mechanisms were identified — static API key, OAuth 2.0 with JWT, and ephemeral SPIFFE-based identities — alongside three tool-calling paradigms: function calling, Model Context Protocol (MCP), and OpenAPI specifications. A critical finding establishes that credential isolation from the LLM context is a non-negotiable security requirement in agentic systems. It is concluded that security management, resilience patterns, and protocol-agnostic integration must be treated as first-level architectural components from the design phase, providing a conceptual taxonomy that guides engineering decisions in AI-based client-server application development.