Provider keys: one per environment, zero in the logs (step 7/7) · secrets

Checkpoint

One last thing before we move on. Same surface as a write step — but the lesson doesn't complete until this passes.

Final drill. Write the startup guard an ML service runs before it serves a single request: check_deploy(env) takes an environment dict and returns a (verdict, reason) tuple. Rules, in order:

If ANTHROPIC_API_KEY is missing or empty, return ("block", "ANTHROPIC_API_KEY missing") — fail at boot with a clear message, not mid-request with a stack trace.
If APP_ENV is "prod" but the key contains "-dev-", return ("block", "dev key in prod") — someone copied the wrong secret into the prod store, and the low spend limit will throttle real traffic at the worst moment.
Otherwise return ("ok", f"{app_env} key loaded").

The script exercises three environments and prints each verdict.

Expected output:

ok: prod key loaded
block: dev key in prod
block: ANTHROPIC_API_KEY missing

Checkpoint

One last thing before we move on. Same surface as a write step — but the lesson doesn't complete until this passes.

Final drill. Write the startup guard an ML service runs before it serves a single request: check_deploy(env) takes an environment dict and returns a (verdict, reason) tuple. Rules, in order:

If ANTHROPIC_API_KEY is missing or empty, return ("block", "ANTHROPIC_API_KEY missing") — fail at boot with a clear message, not mid-request with a stack trace.
If APP_ENV is "prod" but the key contains "-dev-", return ("block", "dev key in prod") — someone copied the wrong secret into the prod store, and the low spend limit will throttle real traffic at the worst moment.
Otherwise return ("ok", f"{app_env} key loaded").

The script exercises three environments and prints each verdict.

Expected output:

ok: prod key loaded
block: dev key in prod
block: ANTHROPIC_API_KEY missing

full-screen editor opens — close anytime to keep reading.

Provider keys: one per environment, zero in the logs — step 7 of 7