AI generation API env variables: configure local and deployed clients consistently

Environment variables work best when the client validates them once at startup and uses one consistent definition everywhere. A missing API key should fail as a configuration problem before a job submission is attempted. A malformed base URL should not quietly send a credential to an unintended destination.

1. Name client settings explicitly

Use GENACE_API_KEY for the raw key and, if your client needs a configurable origin, GENACE_API_BASE for the API base URL. These are names chosen by this tutorial for your client. They are not fields you submit inside the generation JSON body.

An example environment template can contain placeholders:

GENACE_API_KEY=replace-with-your-private-key
GENACE_API_BASE=https://genace.ai/api/v1

Commit only the template, never a populated private environment file. Do not assume every language runtime automatically reads .env; load it through your framework or chosen environment loader, or provide variables from the shell or deployment platform.

2. Validate configuration without printing the key

function readGenerationConfig(environment) {
  const key = environment.GENACE_API_KEY?.trim();
  if (!key || key === 'replace-with-your-private-key') {
    throw new Error('GENACE_API_KEY must contain a configured private key');
  }
  if (key.startsWith('Bearer ')) {
    throw new Error('GENACE_API_KEY must contain the raw key only');
  }
  const base = new URL(environment.GENACE_API_BASE ||
    'https://genace.ai/api/v1');
  if (base.origin !== 'https://genace.ai' ||
      base.pathname.replace(/\/$/, '') !== '/api/v1' ||
      base.search || base.hash || base.username || base.password) {
    throw new Error('Unexpected generation API base URL');
  }
  return { key, base: base.toString().replace(/\/$/, '') };
}

const config = readGenerationConfig(process.env);
console.log({ generationConfigured: true, apiBase: config.base });

The origin allowlist is an application safeguard for this example. If you intentionally support another deployment, review and add the exact origin instead of disabling URL validation. Keeping a configurable destination and a shared credential together deserves a narrow policy.

3. Match the variable to the actual process

For PowerShell, $env:GENACE_API_KEY sets the value in the current process environment and its subsequently launched children. For a POSIX shell, export the value before launching the client. Avoid typing a real secret into commands that your shell records when a secret manager or protected environment configuration is available.

A running server does not automatically reread a terminal’s later environment changes. Restart the relevant process after changing configuration. Similarly, local settings do not populate a hosted deployment, a CI runner, or a container. Configure each runtime through its own secret mechanism and keep a list of the consumers that need rotation.

4. Keep frontend and backend settings distinct

Do not use client-exposed environment prefixes for the generation key. The browser can call your authenticated application route, which uses the server key for the upstream request. A public base URL may be harmless by itself, but a private credential is not a frontend configuration value.

When diagnosing a 401, check that the value is nonempty, the placeholder is gone, and the request adds exactly one Bearer prefix. Do not print the full environment or copy Authorization headers into support messages. A rejected credential and an absent variable are different problems and should produce different local diagnostics.

Common mistakes and verification

Avoid inconsistent variable names across a worker and web server. Also avoid storing JSON quotes as part of the actual secret value when entering it into a deployment dashboard. Environment templates, shell syntax, and dashboard input fields can have different quoting rules.

Verify startup rejects placeholders and unexpected origins, logs report only configuration presence, and a missing key never triggers a submission. Confirm local, CI, container, and hosted environments each receive the intended value. After rotation, restart consumers and check authentication through an intentional authorized operation rather than an accidental generation loop.

See server-side key boundaries, Docker runtime injection, and GitHub Actions secrets for environment-specific examples.

Continue with code and integration

• AI generation API Docker: inject secrets when the worker starts
• AI generation API Express: validate requests before forwarding them
• AI generation API FastAPI: build a small asynchronous submission service
• Browse all code and integration guides