APIs & Keys

Learning Objectives

• Store API keys securely using environment variables and .env files
• Make an LLM API call using both the Anthropic Python SDK and raw HTTP
• Compare SDK-based and raw HTTP request/response formats for debugging
• Identify and handle common API errors including authentication and rate limits

The Problem

Starting from Phase 11, you'll call LLM APIs (Anthropic, OpenAI, Google). In Phase 13-16 you'll build agents that use these APIs in loops. You need to know how API keys work, how to store them safely, and how to make your first API call.

The Concept

Every API call has:

1. An endpoint (URL)
2. An API key (authentication)
3. A request body (what you want)
4. A response body (what you get back)

s0-secret-inject

Build It

Step 1: Store API keys safely

Never put API keys in code. Use environment variables.

export ANTHROPIC_API_KEY="sk-ant-..."
export OPENAI_API_KEY="sk-..."

Or use a .env file (add it to .gitignore):

ANTHROPIC_API_KEY=sk-ant-...
OPENAI_API_KEY=sk-...

Step 2: First API call (Python)

import os

import anthropic

client = anthropic.Anthropic()

MODEL = os.environ.get("LLM_MODEL", "claude-sonnet-5")

response = client.messages.create(
    model=MODEL,
    max_tokens=256,
    messages=[{"role": "user", "content": "What is a neural network in one sentence?"}]
)

print(response.content[0].text)

LLM_MODEL selects the Anthropic model id, and the default is the un-dated Sonnet alias. Other providers (OpenAI, Google, and others) follow the same pattern of a key plus a model id, but each has its own SDK, endpoint, and request/response schema.

Step 3: First API call (TypeScript)

import Anthropic from "@anthropic-ai/sdk";

const client = new Anthropic();

const MODEL = process.env.LLM_MODEL ?? "claude-sonnet-5";

const response = await client.messages.create({
  model: MODEL,
  max_tokens: 256,
  messages: [{ role: "user", content: "What is a neural network in one sentence?" }],
});

console.log(response.content[0].text);

Step 4: Raw HTTP (no SDK)

import os
import urllib.request
import json

url = "https://api.anthropic.com/v1/messages"
headers = {
    "Content-Type": "application/json",
    "x-api-key": os.environ["ANTHROPIC_API_KEY"],
    "anthropic-version": "2023-06-01",
}
body = json.dumps({
    "model": os.environ.get("LLM_MODEL", "claude-sonnet-5"),
    "max_tokens": 256,
    "messages": [{"role": "user", "content": "What is a neural network in one sentence?"}],
}).encode()

req = urllib.request.Request(url, data=body, headers=headers, method="POST")
with urllib.request.urlopen(req) as resp:
    result = json.loads(resp.read())
    print(result["content"][0]["text"])

This is what the SDKs do under the hood. Understanding the raw HTTP call helps when debugging.

Use It

For this course:

You don't need all of them right now. Set them up when the lesson requires it.

Ship It

This lesson produces:

• outputs/prompt-api-troubleshooter.md - diagnose common API errors

Exercises

1. Get an Anthropic API key and make your first API call
2. Try the raw HTTP version and compare the response format to the SDK version
3. Intentionally use a wrong API key and read the error message

Hints

Exercise 1. Create a key in the Anthropic Console, put it in ANTHROPIC_API_KEY as shown in the lesson, and run code/first_api_call.py. The call works when the script prints the model reply and no error.

Exercise 2. Both functions in code/first_api_call.py print only the text and the token counts. Add print(response) in call_with_sdk() and print(result) in call_raw_http(), then run the script to see both full responses. Compare the field names: the raw JSON has the same content, usage, and stop_reason fields that the SDK turns into object attributes.

Exercise 3. Set ANTHROPIC_API_KEY to a fake value in one terminal only, then run the script again. Find the HTTP status code and the error type in the output; an authentication failure returns a 401 status.

Key Terms