Implementing AI Agent with External API Access in a Mobile Application
AI agent with external API access is not just Function Calling. It's architecture where model independently decides what sequence of external service requests to execute for answer. User writes "book me flight to Berlin next Friday, hotel near center under 100 euros"—agent searches flights, picks optimal, searches hotels matching criteria, compares options, then only proposes to confirm. Multiple APIs, multiple steps, minimal user intervention.
Orchestration Loop and Mobile Implementation
Agent's heart—loop: LLM → tool_calls → execute → LLM → .... On mobile, lives either client-side or server-side (recommend second for complex agents). Client loop suitable for 2–4 tools without long dependency chains.
// Android—agent cycle
suspend fun runAgent(userMessage: String): String {
val messages = mutableListOf(Message(role = "user", content = userMessage))
repeat(MAX_ITERATIONS) {
val response = llmClient.complete(messages, tools = availableTools)
if (response.finishReason == "stop") return response.content ?: ""
if (response.finishReason == "tool_calls") {
messages.add(response.toAssistantMessage())
response.toolCalls.map { call ->
async { toolDispatcher.dispatch(call.name, call.arguments) }
}.awaitAll().forEachIndexed { i, result ->
messages.add(Message(role = "tool", toolCallId = response.toolCalls[i].id, content = result))
}
}
}
return "Agent couldn't complete task in $MAX_ITERATIONS iterations"
}
MAX_ITERATIONS is critical protection. Without it, agent can loop and burn token budget. For most tasks, 10 iterations sufficient.
Real Problems with External API Access
Authentication and token security. Agent calls external APIs on user's behalf—needs tokens (OAuth, API key). Never store others' API keys in mobile app in plaintext. Right scheme: mobile client → your backend (with validation) → external API. Backend stores tokens, proxies requests, logs calls. Else key leaks via APK decompilation.
Rate limiting and timeouts. External APIs limit requests. If agent makes 5 requests to one service in 2 seconds, gets 429 Too Many Requests. Need retry with exponential backoff: first retry after 1s, second after 2s, third after 4s. OkHttp Interceptor allows implementing transparently for all calls.
Unpredictable API responses. External APIs return data in different formats, different error codes, sometimes return HTML instead of JSON on infrastructure errors. Each tool must return agent understandable error text, not throw exception. Agent knows how to work with errors—if passed {"error": "Airline unavailable, try another"}, it switches alternative.
Agent Tools: Description Decides Everything
Architecturally, each external API—one or multiple tools with clear description. Example for flight booking API:
{
"name": "search_flights",
"description": "Searches available flights. Use ONLY when user wants find or book flight. Don't use for hotels or transfer.",
"parameters": {
"origin": {"type": "string", "description": "IATA airport code, e.g., MSQ, SVO"},
"destination": {"type": "string", "description": "IATA airport code"},
"date": {"type": "string", "description": "Date in YYYY-MM-DD format"},
"passengers": {"type": "integer", "default": 1}
}
}
Word "ONLY" in description matters—without explicit limits, model may call tool in wrong context.
Server Agent vs Client
For agents with 5+ APIs, long call chains, or sensitive data—recommend server orchestration. Client sends task, receives updates via WebSocket or long polling, renders progress. Allows:
- Continuing agent work when app minimized
- Caching intermediate results
- Logging each step for debug
- Not exposing external API keys on client
On mobile—just UI: agent step progress indicator, cancellation option, final result card with action confirmation.
Workflow Stages
Audit external APIs and their authentication → design tools and schemas → implement backend proxy (if needed) → agent cycle with loop-prevention → handle rate limit and timeouts → agent progress UX on client → test scenarios with API errors → monitor and alert.
Timeline: agent with 3–5 external APIs, server orchestration—4–7 weeks. Client agent for 2–3 simple APIs—2–3 weeks.