Integrating AI content detection into an application often comes up when teams need a way to flag machine-generated submissions. While detectors cannot provide absolute certainty, they offer a useful signal that editors, educators, and moderators can review before making a final decision. Building a Node.js and Express application allows developers to accept text, send it to a detection API, and render a sentence-by-sentence breakdown highlighting potentially machine-written portions.
Setting Up the Project and API Integration
Most AI detection services follow a submit, poll, and fetch pattern. For this implementation, the Quetext AI Detector API evaluates individual sentences and provides a score without requiring an initial paid subscription. Because analysis takes a few seconds, the API returns a ticket identifier that your application must use to poll for the completed report.
Security is the first priority when handling API keys. Never hard-code your credentials or expose them to the browser; instead, store the key in a server-side environment variable. Additionally, note the usage constraints: the minimum input size is typically 50 words—since detectors require enough context to evaluate patterns—and rate limits (such as 10 requests every 5 seconds per account) apply to every status check and progress call.
Building the Backend Modules
Isolating provider-specific logic inside a dedicated module, such as quetext.js, ensures the rest of your application remains decoupled from third-party field names and endpoints. Key design decisions for this module include:
- Preserving HTTP status codes: Passing through specific codes like a 402 for depleted credits or a 429 for rate-limiting allows you to handle errors precisely.
- Controlled polling intervals: Polling every 2.5 seconds aligns with recommended intervals and prevents unnecessary depletion of your rate limit.
- Hard timeouts: Enforcing a strict timeout prevents stuck reports from hanging server requests indefinitely.
The main server file, server.js, validates user input, handles the sequence of API requests, and maps external payload fields into a clean internal format (translating raw metrics like generated_prob into a standardized probability score). This abstraction ensures that switching to a different detection provider later only requires updating a single file.
Rendering Results and Handling Security
Presenting raw numerical percentages can lead users to hasty conclusions. Displaying text with individual sentences shaded based on their likelihood of being AI-generated encourages a closer, more nuanced reading. In the frontend template, user text processed via external services must be treated as untrusted data. Using methods like textContent rather than innerHTML prevents cross-site scripting vulnerabilities in accordance with standard security practices.
Production Considerations and Limitations
Running HTTP requests that wait openly while polling works fine locally, but real-world traffic requires a background architecture. In a production setting, you should submit the text, save a pending report identifier in your database, and respond immediately. A background worker—utilizing tools like BullMQ, cron jobs, or serverless queues—should handle the polling loop across pending reports. This centralized approach prevents concurrent user requests from collectively triggering rate-limit errors (HTTP 429).
Other operational safeguards include:
- Caching results: Hash incoming text so that identical drafts submitted multiple times do not incur duplicate API costs.
- Cost management: Because detection services charge per word, restrict checks to high-value inputs like article submissions or student assignments rather than casual comments.
- Accounting for false positives: Non-native English speakers are frequently misidentified by AI detectors because simpler vocabulary and textbook grammar appear predictable to language models.
Ultimately, AI detection should serve as a rapid first-pass filter to direct human attention, never as an automated blocker that penalizes users without review.
