Phase 0 · Tools · Talking to APIs
API keys and secrets
Authenticate safely and keep keys out of your code.
Why it matters
An API key for an LLM provider is a direct line to your credit card. Anyone who has it can run up charges in your name, and leaked keys are found and abused within minutes of being pushed to a public repository. Handling keys properly is a small habit that every AI tutorial assumes you already have, and it's the one beginners most often get wrong.
What you'll be able to do
- Send an API key in the header an API expects
- Read a key from an environment variable instead of writing it in code
- Keep keys out of git with a .env file and .gitignore
- Respond correctly when a key leaks
Before this lesson
Next in this phase: Your first LLM call