Module 1 · Foundations

Setup, keys & your first call

Beginner 14 min read Done securely from the start

Setup takes five minutes: a virtual environment, the openai package, and an API key in an environment variable. The one rule that matters: an API key is a password with a credit card attached. It never goes in code, notebooks, Git or chat messages.

1. Install

python -m venv .venv
source .venv/bin/activate            # Windows PowerShell: .venv\Scripts\Activate.ps1
pip install openai python-dotenv     # (uv users: uv add openai python-dotenv)
python -c "import openai; print(openai.__version__)"

This course was written against openai 2.44 (September 2026). Minor versions add features often; check the SDK changelog when something here does not match.

2. The API key

  1. Create an account on the OpenAI platform, add billing, and create a project (projects isolate keys, limits and usage per application).
  2. Create an API key for that project. It is shown once, so copy it into your password manager.
  3. Set spending limits and usage alerts for the project before writing any loops.
export OPENAI_API_KEY="sk-..."                  # macOS/Linux, current shell only
setx OPENAI_API_KEY "sk-..."                    # Windows, persists for new terminals
OPENAI_API_KEY=sk-...
from dotenv import load_dotenv
load_dotenv()                  # copies .env into os.environ; OpenAI() then finds the key
Leaked keys are found in minutes

Bots scan public repositories continuously. If a key is ever committed, revoke it immediately. Deleting the commit is not enough, because it stays in Git history and forks. In production, load keys from a secret manager (AWS Secrets Manager, Azure Key Vault, Databricks secrets) and use separate keys per environment.

3. Your first call

from openai import OpenAI

client = OpenAI()      # reads OPENAI_API_KEY (and optional OPENAI_PROJECT, OPENAI_BASE_URL) from the environment
response = client.responses.create(
    model="gpt-5.6-luna",                       # check the current models page; names change
    input="Explain what a data lakehouse is in two sentences.",
)
print(response.output_text)
print(response.usage)

4. Running every example without a key: fake_openai.py

Download openai-sdk/fake_openai.py from this site's repository and put it next to your script. It creates a normal OpenAI client whose HTTP traffic goes to a small local fake server, so the real SDK code runs (request building, retries, parsing, streaming, error types) with scripted replies. That is how every example in this course was executed, and why the outputs you see are real SDK output.

from fake_openai import fake_client

client = fake_client(script=["A lakehouse stores data as open files in cheap object storage "
                             "and adds transactions and governance on top."])
response = client.responses.create(model="gpt-5.6-luna",
                                   input="Explain what a data lakehouse is in two sentences.")
print(response.output_text)
print(response.usage.input_tokens, response.usage.output_tokens)   # the fake estimates ~4 chars/token
print(type(client).__name__, client.base_url)
A lakehouse stores data as open files in cheap object storage and adds transactions and governance on top. 12 26 OpenAI https://fake.openai.local/v1/
Fake versus real

The fake server returns exactly what the script says, so it teaches the mechanics: request shapes, response types, the tool loop, retries, streaming events. It cannot teach you how a real model phrases things. Swap fake_client(...) for OpenAI() to see real answers. The rest of each example stays the same.

5. Client options worth setting

from fake_openai import fake_client

client = fake_client(timeout=20.0, max_retries=3)   # the same keyword arguments OpenAI(...) accepts
print(client.timeout, client.max_retries)

strict = client.with_options(timeout=5.0, max_retries=0)   # per-call overrides, no new client
print(strict.timeout, strict.max_retries)
20.0 3 5.0 0

Create one client per application and reuse it, because it holds a connection pool. The defaults are a 10-minute timeout and 2 retries. Most applications want a shorter timeout (lesson 12).

Recap

  • venv + pip install openai; one project and key per application.
  • Keys live in environment variables or a secret manager, never in code or Git; revoke leaked keys.
  • OpenAI() reads the key from the environment; reuse one client.
  • fake_openai.py runs the real SDK offline, which is how this course's outputs were produced.

Checkpoint

1 · You pushed a commit containing your API key, then deleted it in the next commit. What now?
Git history (and any forks or clones) still contain the key, and automated scanners find public keys within minutes.