Setting Up the Workshop 🧰
The unglamorous chapter. Get this right and everything after it is pleasant; get it wrong and you will fight your own machine for a week. We will also do the single most important security step in the whole project.
A project folder, an isolated environment, the SDK installed, and your API key stored where it cannot leak.
about 25 minutesMake a home for the project
Open a terminal and make a folder. Anywhere you like; your home directory is fine.
mkdir jarvis
cd jarvis
Everything from here happens inside that folder. If a command later does not work,
the first thing to check is whether you are still in it. pwd tells you where
you are.
A virtual environment, and why you want one
Python installs packages globally by default, which means every project on your machine shares one pile of libraries. Two projects wanting different versions of the same thing is a genuinely miserable afternoon.
A virtual environment is a private pile for this project only. It is one command:
python3 -m venv .venv
That makes a .venv folder. Now activate it, which tells this terminal to
use that private pile:
# macOS and Linux
source .venv/bin/activate
# Windows PowerShell
.venv\Scripts\Activate.ps1
Your prompt changes to show (.venv) at the front. That is how you know it
worked.
Activation lasts for that terminal window only. Close it, come back tomorrow, and you must cd jarvis and source .venv/bin/activate again. Forgetting this is behind about half of all ModuleNotFoundError messages in the world.
Install the SDK
One package. The official Anthropic library for Python.
pip install anthropic
It will print a wall of text and finish with something like
Successfully installed anthropic-0.x.y. Check it landed:
python3 -c "import anthropic; print(anthropic.__version__)"
Get an API key
An API key is a password that identifies your account when your program calls Anthropic's computers. Getting one:
- Go to console.anthropic.com and sign in or sign up.
- Add a small amount of credit. Five dollars is far more than this build needs.
- Find API keys and create one. It looks like
sk-ant-api03-…and is very long. - Copy it now. The console shows it once. If you lose it, you delete it and make another; that is normal and costs nothing.
It is a key to your wallet. Anyone who has it can spend your credit. Treat it exactly like a bank card number: never in a screenshot, never pasted into a chat, never committed to git. If you ever think it leaked, delete it in the console and make a new one. That takes ten seconds and completely solves the problem.
The most important step in this chapter
Here is the wrong way, which you will see all over the internet:
# WRONG. Never do this, not even for five minutes.
client = anthropic.Anthropic(api_key="sk-ant-api03-abc123...")
The moment that key is inside a file, it is one careless git push away
from being public, and bots scrape public repositories for exactly this. People have
woken up to large bills.
The right way is to put the key in an environment variable: a value
that lives in your terminal session, outside your code entirely. The SDK looks for one
called ANTHROPIC_API_KEY automatically.
# macOS and Linux
export ANTHROPIC_API_KEY="sk-ant-api03-your-actual-key-here"
# Windows PowerShell
$env:ANTHROPIC_API_KEY="sk-ant-api03-your-actual-key-here"
Now your code never mentions the key at all:
import anthropic
# No api_key argument. The SDK reads ANTHROPIC_API_KEY from the
# environment by itself. Your code stays safe to share.
client = anthropic.Anthropic()
That is not a workaround; it is the SDK's intended default and the reason it works this way.
Making it stick
export also only lasts for that terminal. To set it every time, add the
same line to your shell's startup file, then open a new terminal:
# zsh, the default on modern macOS
echo 'export ANTHROPIC_API_KEY="sk-ant-...";' >> ~/.zshrc
# bash, common on Linux
echo 'export ANTHROPIC_API_KEY="sk-ant-...";' >> ~/.bashrc
Check it without printing it
Verifying the key is set is useful. Printing it to your screen is not, because screens end up in screenshots. So check its shape, never its value:
import os
key = os.environ.get("ANTHROPIC_API_KEY")
if not key:
print("No key found. Did you export it in THIS terminal?")
elif not key.startswith("sk-ant-"):
print("Found something, but it does not look like an Anthropic key.")
else:
print(f"Key found: {{len(key)}} characters, starting sk-ant- and ending {{key[-4:]}}")
Save that as check_key.py and run python3 check_key.py. You
want the third message. Notice it prints the length and the last four characters, which
is enough to tell two keys apart and useless to a thief.
The instinct to print the whole key to 'just check it worked' is completely natural and completely wrong. Fingerprints, not passwords. Every good system you will ever use does this: the last four digits of your card, and nothing more.
Tell git to ignore the dangerous things
Even though the key is not in your code, make the mistake impossible. Create a file
called .gitignore:
# .gitignore
.venv/
__pycache__/
*.pyc
# never commit secrets or saved conversations
.env
history.json
notes/
Git now refuses to track those, so a slip cannot publish your environment, your saved chats, or your notes. Lesson f3 covers git properly if this is unfamiliar.
If it went wrong
command not found: python3Python is not installed or not on your PATH. Base Camp 2 covers this. On Windows trypyinstead.ModuleNotFoundError: No module named 'anthropic'Almost always an inactive virtual environment. Look for(.venv)in your prompt; if it is missing, activate it and try again.- The key check says "No key found" You exported it in a different terminal window, or you opened a new one since. Export it again here, or add it to your shell startup file as above.
Running python3 check_key.py prints a line saying your key was found, with its length and last four characters. Your prompt shows (.venv), and pip show anthropic finds the package.