Jarvis · Chapter 2

Setting Up the Workshop 🧰

The unglamorous chapter. Get this right and everything after it is pleasant; get it wrong and you will fight your own machine for a week. We will also do the single most important security step in the whole project.

Goal

A project folder, an isolated environment, the SDK installed, and your API key stored where it cannot leak.

about 25 minutes

Make a home for the project

Open a terminal and make a folder. Anywhere you like; your home directory is fine.

mkdir jarvis
cd jarvis

Everything from here happens inside that folder. If a command later does not work, the first thing to check is whether you are still in it. pwd tells you where you are.

A virtual environment, and why you want one

Python installs packages globally by default, which means every project on your machine shares one pile of libraries. Two projects wanting different versions of the same thing is a genuinely miserable afternoon.

A virtual environment is a private pile for this project only. It is one command:

python3 -m venv .venv

That makes a .venv folder. Now activate it, which tells this terminal to use that private pile:

# macOS and Linux
source .venv/bin/activate

# Windows PowerShell
.venv\Scripts\Activate.ps1

Your prompt changes to show (.venv) at the front. That is how you know it worked.

🔁 You have to do this every time

Activation lasts for that terminal window only. Close it, come back tomorrow, and you must cd jarvis and source .venv/bin/activate again. Forgetting this is behind about half of all ModuleNotFoundError messages in the world.

Install the SDK

One package. The official Anthropic library for Python.

pip install anthropic

It will print a wall of text and finish with something like Successfully installed anthropic-0.x.y. Check it landed:

python3 -c "import anthropic; print(anthropic.__version__)"

Get an API key

An API key is a password that identifies your account when your program calls Anthropic's computers. Getting one:

  1. Go to console.anthropic.com and sign in or sign up.
  2. Add a small amount of credit. Five dollars is far more than this build needs.
  3. Find API keys and create one. It looks like sk-ant-api03-… and is very long.
  4. Copy it now. The console shows it once. If you lose it, you delete it and make another; that is normal and costs nothing.
🔑 What this key actually is

It is a key to your wallet. Anyone who has it can spend your credit. Treat it exactly like a bank card number: never in a screenshot, never pasted into a chat, never committed to git. If you ever think it leaked, delete it in the console and make a new one. That takes ten seconds and completely solves the problem.

The most important step in this chapter

Here is the wrong way, which you will see all over the internet:

# WRONG. Never do this, not even for five minutes.
client = anthropic.Anthropic(api_key="sk-ant-api03-abc123...")

The moment that key is inside a file, it is one careless git push away from being public, and bots scrape public repositories for exactly this. People have woken up to large bills.

The right way is to put the key in an environment variable: a value that lives in your terminal session, outside your code entirely. The SDK looks for one called ANTHROPIC_API_KEY automatically.

# macOS and Linux
export ANTHROPIC_API_KEY="sk-ant-api03-your-actual-key-here"

# Windows PowerShell
$env:ANTHROPIC_API_KEY="sk-ant-api03-your-actual-key-here"

Now your code never mentions the key at all:

import anthropic

# No api_key argument. The SDK reads ANTHROPIC_API_KEY from the
# environment by itself. Your code stays safe to share.
client = anthropic.Anthropic()

That is not a workaround; it is the SDK's intended default and the reason it works this way.

Making it stick

export also only lasts for that terminal. To set it every time, add the same line to your shell's startup file, then open a new terminal:

# zsh, the default on modern macOS
echo 'export ANTHROPIC_API_KEY="sk-ant-...";' >> ~/.zshrc

# bash, common on Linux
echo 'export ANTHROPIC_API_KEY="sk-ant-...";' >> ~/.bashrc

Check it without printing it

Verifying the key is set is useful. Printing it to your screen is not, because screens end up in screenshots. So check its shape, never its value:

import os

key = os.environ.get("ANTHROPIC_API_KEY")

if not key:
    print("No key found. Did you export it in THIS terminal?")
elif not key.startswith("sk-ant-"):
    print("Found something, but it does not look like an Anthropic key.")
else:
    print(f"Key found: {{len(key)}} characters, starting sk-ant- and ending {{key[-4:]}}")

Save that as check_key.py and run python3 check_key.py. You want the third message. Notice it prints the length and the last four characters, which is enough to tell two keys apart and useless to a thief.

Composure[Easy: Success]

The instinct to print the whole key to 'just check it worked' is completely natural and completely wrong. Fingerprints, not passwords. Every good system you will ever use does this: the last four digits of your card, and nothing more.

Tell git to ignore the dangerous things

Even though the key is not in your code, make the mistake impossible. Create a file called .gitignore:

# .gitignore
.venv/
__pycache__/
*.pyc

# never commit secrets or saved conversations
.env
history.json
notes/

Git now refuses to track those, so a slip cannot publish your environment, your saved chats, or your notes. Lesson f3 covers git properly if this is unfamiliar.

If it went wrong

✅ Checkpoint

Running python3 check_key.py prints a line saying your key was found, with its length and last four characters. Your prompt shows (.venv), and pip show anthropic finds the package.

+150 XP