Setup: Python, Keys, and Safety

You can run most Joeven Try it yourself boxes in the browser. For projects, use a real machine. This lesson is the bridge: what to install, where secrets live, and which safety habit starts today.

It exists because agents touch APIs, files, and sometimes money. A leaked key is not a vibe. It is a billing event. An eval of model-written code on your laptop with full permissions is not a shortcut. It is a way to run an attacker’s instructions with your login.

People confuse setup with “install a 40-package agent framework.” You do not need that yet. You need Python 3.11 or newer, a virtual environment, and a place for keys that is not git. A virtual environment (venv) is a private folder of packages for one project so course libraries do not collide with the rest of your computer. You also do not need a GPU, Kubernetes, or a vector database account to begin.

Python on your machine

Install Python 3.11+ from python.org. On Windows, tick Add python.exe to PATH. PATH is the list of folders your system searches for programs.

Create a virtual environment, turn it on, then upgrade pip. pip is the program that installs packages into the venv.

python -m venv .venv
# Windows
.venv\Scripts\activate
# macOS/Linux
source .venv/bin/activate
pip install --upgrade pip

When the venv is on, python and pip use that folder. When you are done, type deactivate. Do not commit the .venv folder to git. Commit a list of packages later, when you have one.

Packages you will actually use

Not fifty frameworks. A small core on your laptop:

• httpx or requests — HTTP. HTTP is how programs ask servers for data.
• pydantic — schemas. A schema is a description of what fields and types you allow.
• pytest — tests
• One vendor SDK when you need it (openai, anthropic, and similar)

Frameworks (LangChain, CrewAI, AutoGen, smolagents) are optional after you can write the loop yourself. Joeven teaches the loop first. Joeven’s browser has no pip and no network. Live boxes stay on the standard library — modules that come with Python, such as os, json, and math.

API keys

An API key is a secret string that proves you may call a vendor. Never paste keys into Joeven, GitHub, or a screenshot.

• Store keys in environment variables or a local .env file that is gitignored. An environment variable is a name your operating system keeps, like WEATHER_API_KEY, that programs can read without baking the value into source code.
• Restrict keys by origin and spend limit in the vendor dashboard
• Use a separate key for experiments with a hard monthly cap

If a key leaks, revoke it immediately. Then rotate (make a new key, delete the old one). Then check billing.

A leaked-key story

Alex commits a file named demo.py with a real key in a string so “the team can run it.” GitHub scanners may catch it. Bots may catch it first. Overnight the experiment key is used from another country. The dashboard shows a spend spike. Alex revokes the key, but the commit still lives in history until it is treated as burned forever.

The fix is not a comment that says “do not share.” The fix is: load the key from the environment, fail if it is missing, never print the full value, never put it in the prompt. The classroom box simulates os.environ because the browser is not your laptop. The pattern is the same.

Run to execute this in your browser. Nothing is sent to a server.

You should see the length of the demo string, a redacted prefix sk-demo..., the reminder not to log full keys, and True for the missing name. The loader concatenates the error text with the variable name; it does not use an f-string. In production you would raise if OTHER_API_KEY were required. Here we only show that get returns empty rather than crashing the demo. Try deleting the os.environ[...] line and calling load_key("WEATHER_API_KEY") — you should get a runtime error that names the variable, not a silent empty key.

Watch out:If a key leaks, revoke it immediately. Then rotate. Then check billing.

What you do not need yet

• A GPU
• Kubernetes
• Fine-tuning
• A vector database account (we will simulate first, then you can bring Pinecone, pgvector, or Chroma)

Safety default

Treat every model output as untrusted. It can be wrong, leaked, or prompt-injected. Prompt injection means untrusted text (a web page, an email, a ticket) that tries to change the model’s instructions. Later lessons make this precise. The habit starts now: validate JSON, sandbox tools, never eval model-generated code on your laptop with full permissions. Joeven lessons will not use exec. You should not either for model text.

What goes wrong

• Key in the prompt. The transcript gets logged. The log is copied. The key is gone.
• Key in git. History keeps secrets after you delete them from the latest file.
• One key for prod and play. A toy loop burns the production spend cap.
• Full key in print. The same habit that helped you debug now ships secrets to log software.
• pip install a name the model invented. Typosquat packages exist on purpose. Read the name. Pin versions.
• eval or exec on model code. The model is not a safe compiler. It can follow injected instructions.
• Assuming Joeven is a secret vault. It is a browser classroom. No keys here.
• Skipping the venv. Global packages collide. A course install breaks another project.

Where this goes next

The next lesson is tokens, tools, and goals — the three scarce resources once keys work. The Python track will go deeper on venv and HTTP on your laptop. Production will cover secret managers and rotation as a process. Evals and safety will turn “untrusted output” into tests and filters. Tools will add timeouts and allow-lists. Do not wait for those tracks to gitignore .env.

How agents use this

Setup is part of the agent’s environment. A tool that reads os.environ is how the agent calls a vendor. A tool that prints the key is a bug.

• Code: one load_key function. Missing keys raise. Demo keys are clearly fake. Never concatenate a secret into a prompt string. Pass a client object that already has the key, not the key itself, into the loop.
• Logs: log key length, key name, and last four characters only if your security policy allows even that. Never log the full secret. Log missing: OTHER_API_KEY when load fails.
• Tests: missing env raises. Demo prefix is accepted only in classroom mode. A fake os.environ in tests must not use a real key. Assert that a trace fixture has no substring equal to the secret.
• Stop conditions: refuse to start the loop if required keys are missing. Refuse to start if spend-cap metadata says the experiment key is exhausted. Human handoff if a tool returns 401 unauthorized after a retry — do not spin.

The classroom returns a demo key so you can practice load and redact. On your machine, set the variable in the OS, not in a chat window.