Lesson · 12 min

Keys and settings

A key is a secret

A model service gives you an API key. It is a long text. Your program sends the key with each call, and the service uses it to find the account that pays.

A person who has your key can make calls, and you pay for them. Keep a key as safe as a password.

In the lessons before this one, the key was in the code: Client(api_key="test-key-lesson"). That is correct only for a key that is not real.

How a key gets out

In the code. You share the file, or you put it in a public repository. Programs search public repositories for keys all the time, and they find a new key in minutes.
In a message. You paste the code into a chat, a forum, or a screenshot.
In the output. The program prints its settings, and the output goes to a log that other people can read.
In a web page. Each visitor can read the code that runs in a browser. A call with a key belongs on a server.

Environment variables

An environment variable is a named value that the operating system gives to a program when the program starts. The value is not in the code. You set it in the terminal.

export MODEL_API_KEY="your-key"

This line is for macOS and Linux. In PowerShell on Windows, the line is $env:MODEL_API_KEY = "your-key".

The program reads the variable with os.environ. It works like a dictionary of texts.

import os

key = os.environ.get("MODEL_API_KEY", "")

os.environ["MODEL_API_KEY"] stops with a KeyError when the variable is missing. get returns the second argument in that case.

Check the key when the program starts. A missing key then gives a clear message at once, and not an AuthError somewhere in the middle of the work.

if key == "":
    raise RuntimeError("Set the variable MODEL_API_KEY.")

The statement raise stops the program with the error that you name. The text of the error tells the person who starts the program what to do.

Many projects keep their variables in a file with the name .env, and a tool loads the file. Such a file must not go into the repository. Add its name to the file .gitignore.

The variables of this lesson

A lesson has no terminal. So the file lesson_env.py sets two variables, and main.py imports it. On your computer, you do not need such a file.

The key in lesson_env.py is not a real key. The simulated service accepts each key that starts with test-key.

Do not type a real key into a lesson. The simulated service does not need one, and the site saves the code that you write.

Settings that are not secret

The name of the model is a good setting too. When it comes from an environment variable, you can change the model and not change the code. Give such a setting a default value.

Do not show a key

Do not print a key, and do not write it to a log. When you must show which key is in use, show the last 4 characters only: *********4f9a.

When a key got out

Delete the key in your account of the service, and make a new key. It is not enough to remove the key from the file. The old versions of a file in a repository still have it.

Two more settings protect you. Set a spending limit in the account. And use one key for each program, so that you can delete one key and the other programs continue to work.

Your turn

main.py imports lesson_env, which sets the variables. Do the tasks in order.

Tasks

4 to do

Task 1, not checked yet. Write a function get_key(). It reads the environment variable MODEL_API_KEY. When the variable is missing or empty, the function raises a RuntimeError with a text that has the name MODEL_API_KEY in it. When not, it returns the key.
Task 2, not checked yet. Write a function mask(key). It returns a text of the same length. The last 4 characters stay, and each other character becomes *. For a key with 4 characters or less, each character becomes *.
Task 3, not checked yet. Write a function get_model(). It returns the value of the environment variable MODEL_NAME. When the variable is missing, it returns sim-small.
Task 4, not checked yet. Make a client with the key from get_key() and the model from get_model(): Client(api_key=..., model=...). Call it with messages, and store the response in response. Print the masked key and the name of the model in the response. Do not print the key, and do not write the key in main.py.

Task 1 of 4

Write a function get_key(). It reads the environment variable MODEL_API_KEY. When the variable is missing or empty, the function raises a RuntimeError with a text that has the name MODEL_API_KEY in it. When not, it returns the key.

All tasks