What you’ll learn

  • How to create an OpenAI API account (it’s separate from a ChatGPT subscription)
  • How to add a small amount of prepaid credit and turn off auto-reload
  • How to set a hard spend limit so you can’t be surprised by a bill
  • How to create an API key and copy it safely
  • How to store the key in a .env file and protect it with a .gitignore file

Before you start

  • You need an email address, a phone number for verification, and a credit or debit card.
  • A ChatGPT subscription doesn’t include API credit. The API is billed separately, even if you use the same login.
  • Plan to spend $5, the minimum purchase. That’s usually more than enough for this whole course.
  • Have your ai-app-course folder open in VS Code.

Step 1: Create your API account

  1. Go to platform.openai.com and sign up or log in.
  2. If you’re asked to create an organization, enter your name (or your business name) and continue.
  3. Complete phone verification if you’re asked.

You’re now on the OpenAI API platform. This is where you’ll manage keys, credits and limits.

Step 2: Add credit and turn off auto-reload

New API accounts use prepaid billing: you buy credit first, and each request uses a little of it.

  1. Open Settings, then Billing.
  2. Choose to add a payment method or buy credits, whichever appears.
  3. Enter $5. That’s the minimum purchase (the default is $10).
  4. Turn off auto-reload before you confirm. It’s on by default. If you leave it on, OpenAI automatically buys more credit when your balance gets low.
  5. Confirm the purchase. Your balance can take a few minutes to appear.

Good to know: purchased credits expire after 1 year and generally aren’t refundable, so start small.

Step 3: Set a hard spend limit

A spend limit is your safety net. If something goes wrong, or your key ever leaks, requests stop once the limit is reached.

  1. Open Settings, then your project’s Limits.
  2. In Spend, select Edit spend limit.
  3. Enter a monthly limit, such as $5.
  4. Turn on Enforce a hard limit. Without this, the limit only sends you an email.
  5. Select Save.

When the limit is reached, requests fail with a 429 error, which you learned about in the last lesson. Enforcement isn’t instant, so spending can go slightly over the limit, but it stops runaway costs.

Step 4: Create your API key

  1. Go to API keys (platform.openai.com/api-keys).
  2. Select Create new secret key.
  3. Give it a name you’ll recognize, like ai-app-course.
  4. Leave the permissions as they are (All) and the project as Default project.
  5. Select Create secret key.
  6. Copy the key right away. OpenAI shows the full key only once. If you lose it, delete it and create a new one.

Your key starts with sk- and is very long. Don’t paste it anywhere except the .env file in the next step.

Step 5: Save the key in a .env file

A .env file (say “dot env”) is a small text file that holds secrets like API keys. Your code reads the key from this file, so the key never appears in your code.

  1. In VS Code, open your ai-app-course folder.
  2. Select New File and name it exactly .env (a dot, then env, with nothing before or after).
  3. Type this line, then paste your key after the equals sign:
OPENAI_API_KEY=sk-paste-your-key-here
  1. Save the file.

Rules for the .env line:

  • OPENAI_API_KEY is the name your code will look for, in capitals, spelled exactly.
  • No spaces around the =.
  • No quotes around the key.
  • One key per line.

Step 6: Protect the key with a .gitignore file

Later in the course, you’ll save your project to GitHub so you can share it. A .gitignore file tells Git which files to leave out, so your .env file never gets uploaded.

  1. Create another new file named exactly .gitignore.
  2. Add these lines and save:
.env
__pycache__/
.venv/

You’ll learn more about GitHub at the end of the course. Setting this up now means you’re protected from day one.

Example: what your folder looks like now

ai-app-course/
    .env
    .gitignore
    setup_check.py
    assistant_preview.py
    ai_app_flow.py
    api_basics.py
    check_key.py

In the next lesson, you’ll install a package called python-dotenv that reads the .env file for you. Today’s practice file reads it with plain Python, so you can see how it works.

Common mistakes

  • Expecting your ChatGPT plan to cover the API. It doesn’t. The API needs its own credit.
  • Leaving auto-reload on. Turn it off during your first purchase, or check Billing settings now.
  • Setting a spend limit without turning on “Enforce a hard limit.” Then it only sends an email.
  • Closing the key window before copying. The full key is shown only once. Create a new one if you missed it.
  • Naming the file env, .env.txt or env.env. It must be exactly .env. On Windows, Notepad may add .txt, so create the file in VS Code.
  • Adding spaces or quotes. Write OPENAI_API_KEY=sk-… with nothing extra.
  • Pasting the key into a Python file, a screenshot, a support email or a forum post. If that happens, delete the key in OpenAI and create a new one.

Try it, exercise and practice file

Try it: Safe or Risky?

A quick game with eight situations, such as pasting the key into code, posting a screenshot with the key visible, leaving auto-reload on, or printing a masked key. Students click Safe or Risky and get an explanation after each choice, with a progress bar and score. The final screen shows their score and the four safety rules, with a Play again button.

Placement: after “Common mistakes,” before “Hands-on exercise.” Add a heading “Try it: Safe or Risky?,” then a Custom HTML block with the whole contents of lesson4_try_it_widget.html. Install it the same way as before (WP Editor, logged in as an admin).

Text above the widget: Before you create your real key, test your instincts. Decide whether each situation keeps your key and your money safe. Aim for 8 out of 8.

Hands-on exercise

  1. Follow Steps 1 to 4 in the lesson: create your account, add $5 with auto-reload off, set a $5 hard spend limit, and create a key named ai-app-course.
  2. In VS Code, create the .env file in your ai-app-course folder with your key on the OPENAI_API_KEY line.
  3. Create the .gitignore file with .env, pycache/ and .venv/ on separate lines.
  4. Download check_key.py into the same folder and run it with python check_key.py.
  5. Fix any FAIL lines and run it again until every check passes.
  6. Double-check in your OpenAI account: auto-reload is off and “Enforce a hard limit” is on.

Practice file

check_key.py (give to students). Students don’t edit this file; it checks their setup. It reads the .env file with plain Python (no packages needed) and runs five checks:

  1. A file named exactly .env exists. If it finds .env.txt or env instead, it says how to rename it.
  2. The .env file has an OPENAI_API_KEY line, spelled exactly.
  3. The key looks right: it starts with sk-, is long enough, has no quotes or spaces, and isn’t still the example text.
  4. The .gitignore file exists and has a .env line.
  5. The key isn’t pasted into any .py file in the folder.

The file never prints the whole key, only a masked version like sk-…C3d4, and it doesn’t send the key anywhere. There’s no solution file, because the solution is each student’s own setup.

You’re done when: the output shows “Key found: sk-…xxxx” with the last 4 characters of your key, and the last line says “All 5 checks passed! Your key is stored safely.”

Example of a finished run:

Checking your OpenAI key setup
Check 1: PASS - found the .env file
Check 2: PASS - found the OPENAI_API_KEY line
Check 3: PASS - the key looks right. Key found: sk-...C3d4
Check 4: PASS - .gitignore will keep .env off GitHub
Check 5: PASS - your key isn't pasted into any .py file

All 5 checks passed! Your key is stored safely.

Example of a run with mistakes, which students often hit:

Check 1: PASS - found the .env file
Check 2: PASS - found the OPENAI_API_KEY line
Check 3: FAIL - the key doesn't look right (you entered "sk...ere")
  - it's still the example text - paste your real key
  - remove the quotes around the key

Support tip: never ask a student to send you their key or a screenshot of their .env file. Ask them to send the check_key.py output instead, which only shows the masked key.

Flashcards, takeaways, quiz and next lesson

Flashcards (new learning element)

A short flashcard set helps students remember the safety rules before the quiz. In Tutor, build these with the H5P add-on as a Dialog Cards activity (front and back), placed after Key takeaways. If you’d rather not use H5P, I can build a flip-card widget in the same style as the Try it widgets.

Front

Back

Does a ChatGPT subscription include API credit?

No. The API is billed separately, with prepaid credit.

What’s the minimum credit purchase?

$5.

What should you do with auto-reload while learning?

Turn it off, so OpenAI doesn’t buy more credit automatically.

What does “Enforce a hard limit” do?

It stops requests (with a 429 error) once your monthly spend limit is reached.

How many times does OpenAI show your full key?

Once, when you create it. Copy it right away.

What’s the exact line in your .env file?

OPENAI_API_KEY=sk-… with no spaces and no quotes.

What does .gitignore do?

It tells Git which files to leave out, so .env never gets uploaded.

Your key leaked. What do you do?

Delete it on the API keys page, create a new one, and update .env.

Key takeaways

  • The OpenAI API is billed separately from ChatGPT, using prepaid credit. Start with $5.
  • Your three safety shields: a small credit balance, auto-reload off, and a hard spend limit.
  • OpenAI shows your full key only once. Copy it straight into your .env file.
  • The .env line is OPENAI_API_KEY=sk-… with no spaces or quotes.
  • A .gitignore file with a .env line keeps your key off GitHub.
  • If a key leaks, delete it and create a new one. Never share keys, even with friends.
PreviousNext