LLM API Keys: Set Up OpenAI, Anthropic & Gemini (2026)

Every agent tutorial assumes you already have a key and a safe place to keep it — then moves on. So the first real call fails with an auth error, or worse, a hardcoded key ends up on GitHub and runs up a bill. This LLM API key primer covers the part the tutorials skip: where to get a key, how to load it safely, and how to never leak one.

It takes about five minutes once and saves you from the two problems that derail more beginners than any agent bug — a call that won’t authenticate, and a key scraped from a public repo. Let’s set it up properly the first time.

What an LLM API key is

An LLM API key is a secret string that identifies your account when your code calls a model provider. You send it with each request; the provider checks you’re authorised and meters what you use for billing. It’s effectively a password with a credit card attached — anyone who has it can spend on your account (OpenAI docs).

That framing drives every habit in this primer. You want the key reachable by your code but invisible to everyone else — not in the source, not in screenshots, and definitely not in a public repo.

Where to get a key (and the free option)

You only need one provider to start, and most tutorials work with any of the three by changing a single model string.

• Google Gemini — the lowest-friction start. Create a key in Google AI Studio; the free tier is enough to learn and prototype.
• OpenAI — create a key in the platform dashboard; new accounts often get starting credit.
• Anthropic (Claude) — create a key in the Console; strong tool-use reliability, which matters for agents.

Whichever you pick, do one thing immediately: set a billing/usage limit in the dashboard. For learning, costs are a fraction of a cent per call, but a limit is your safety net against a runaway loop or a leaked key.

Load it safely with a .env file

Here’s the pattern every well-written tutorial uses. Put the key in a .env file, keep that file out of git, and read it at runtime with python-dotenv.

pip install python-dotenv

# .env  (this file never gets committed)
OPENAI_API_KEY=sk-your-key-here

import os
from dotenv import load_dotenv

load_dotenv()                       # reads .env into the environment
api_key = os.getenv("OPENAI_API_KEY")

load_dotenv() pulls the file’s values into environment variables, and os.getenv reads one back. The key now lives in a file you control, not in the code you share (python-dotenv). Most SDKs even read the standard variable name automatically, so you often don’t pass the key explicitly at all.

The errors this prevents

Two failures account for most “it won’t run” messages, and both trace back to this setup.

AuthenticationError / 401. The SDK didn’t find a valid key. Usually the .env isn’t in the folder you ran the script from, or load_dotenv() was called after the SDK was imported. Load the env first, and confirm the variable name matches exactly.

A surprise bill. Almost always a key that leaked into a public repo, or a loop with no cap calling the model forever. The billing limit plus .gitignore are the two guards that make this a non-event instead of a horror story.

Quick recap

The whole primer, in five lines:

• An LLM API key is a secret billing token sent with every request.
• Get one from OpenAI, Anthropic, or Gemini (Gemini’s free tier is the easy start).
• Set a billing limit in the dashboard right away.
• Load it from .env with python-dotenv, never hardcoded.
• Add .env to .gitignore — and rotate any key that ever leaks.

Frequently Asked Questions

What is an LLM API key? A secret token that authenticates and bills your account when your code calls a model provider. Treat it like a password.

Are keys free? Creating them is free; usage is billed per token and tiny for learning. Gemini has a free tier; set a billing limit regardless.

How do I keep it safe? Put it in .env, load with python-dotenv, and add .env to .gitignore. Never hardcode it.

Which provider first? Whichever is fastest — Gemini’s free tier is the lowest-friction start; tutorials work with any by swapping the model string.

Conclusion

An LLM API key is just a password with a bill attached, and handling it well is three habits: get a key, load it from a .gitignore‘d .env, and set a spending limit. Do that once and the auth errors and leaked-key horror stories that trip up beginners simply don’t happen — leaving you free to focus on the agent instead of the plumbing.

Which provider did you start with — Gemini’s free tier, OpenAI, or Claude? Tell me in the comments.