Environment & API Key Setup for AI Projects

Introduction

Every lesson from here on assumes a working project with a valid API key. Getting this step wrong is the single most common reason a first AI project fails to run — either the key is missing, or it accidentally ends up committed to a public GitHub repository. This lesson covers doing it correctly, once, in a way that works for the rest of the course.

A Real-Life Analogy First

An API key behaves exactly like a house key. Whoever holds a copy of it can walk in and use whatever is inside — in this case, your account's ability to make paid calls to an AI provider. You would never tape your house key to your front door where anyone walking by could take it. Yet that is exactly what happens when a key gets typed directly into a script and pushed to a public GitHub repository: it is now taped to the front door of the entire internet.

Isolating Your Environment

Use case: a Python virtual environment (or a Node project's local node_modules) keeps one project's installed packages — and their exact versions — separate from every other project on your machine. Think of it as giving each project its own private toolbox instead of sharing one big communal toolbox where tools might go missing or get swapped for a different version. AI SDKs update frequently, so pinning versions per project avoids a working script suddenly breaking because a global package was upgraded for an unrelated project.

python -m venv .venv
source .venv/bin/activate   # on Windows: .venv\Scripts\activate
pip install openai python-dotenv

Loading API Keys with python-dotenv

Use case: python-dotenv reads key-value pairs from a local .env file and loads them into environment variables, so your code can read a secret via os.environ without ever hardcoding it as a string.

# .env
OPENAI_API_KEY=sk-your-real-key-here

from dotenv import load_dotenv
import os
from openai import OpenAI

load_dotenv()  # reads .env into the process environment

client = OpenAI(api_key=os.environ["OPENAI_API_KEY"])

response = client.chat.completions.create(
    model="gpt-4o-mini",
    messages=[{"role": "user", "content": "Say hello in one short sentence."}],
)
print(response.choices[0].message.content)

The Node.js Equivalent

Use case: modern Node.js (v20.6+) reads a .env file natively with the --env-file flag, or you can use the dotenv package for wider compatibility — the pattern is identical to Python: keep secrets in .env, load them into process.env, never hardcode them.

npm install openai dotenv

import 'dotenv/config';
import OpenAI from 'openai';

const client = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });

const response = await client.chat.completions.create({
  model: 'gpt-4o-mini',
  messages: [{ role: 'user', content: 'Say hello in one short sentence.' }],
});

console.log(response.choices[0].message.content);

Keeping Secrets Out of Git

A .env file must never be committed to version control — anyone with access to the repository (or its history, even after a later deletion) could read the key and rack up usage on your account. The fix is a single line added before your first commit.

# .gitignore
.env
.venv/
node_modules/

Day-to-Day Habits That Prevent Disasters

This is one of the very few lessons in this course where getting it wrong has a real financial consequence, not just a bug — so it is worth a few habits that cost almost nothing but prevent almost every incident beginners run into.

Common Mistakes

Best Practices

Frequently Asked Questions

Key Takeaways

Summary

A safe, isolated environment with correctly-loaded secrets is the foundation every later lesson in this course builds on. Getting it right once here means every following example just works.