Storing the API key in .env

Storing the API key in .env

Storing the API key in .env matters because without a stable API layer FirmAssist cannot talk to the model reliably.

You now bootstrap FirmAssist: API key, folder structure, and the first PHP call that returns a model response.

In depth

Here you build the minimal production flow: configuration, HTTP call, response parsing, and safe error handling. If this layer is clean, later chat, OCR, and RAG features in FirmAssist can reuse it without duplicating code or improvising solutions.

Key points

• Secrets stay on the server only.
• The payload must be readable and valid.
• HTTP status and body are checked separately.
• Timing and error logs help later debugging.

Practical example

Centralized loading of the AI secret.

$env = parse_ini_file(__DIR__ . '/../.env');
$apiKey = $env['OPENAI_API_KEY'] ?? '';

if ($apiKey === '') {
    throw new RuntimeException('OPENAI_API_KEY is missing.');
}

Common mistake

The mistake is hiding every failure behind one generic message.

Summary

After this lesson you can build a stable AI endpoint that FirmAssist uses as the base for later modules.