Build the brain in a box: your first server.

Why the game can't hold the key

Obvious question first: why can't the game just call the API itself? Because your game is a webpage, and a webpage's code is visible to anyone who opens it. Right-click, View Source, there's everything. Put your API key in the game and you haven't hidden a secret — you've published a credit card number and taped it to a window. Course 02 taught you that webpages can't rummage through your computer, and you were glad about the wall. This is the same wall from the other side: the browser is a glass room, and secrets don't live in glass rooms.

Every AI product ever shipped solves this the same way: the key lives on a server, and the app talks to the server. The server is the only thing that ever talks to Anthropic. Today you build that — not a toy version of it, the actual shape.

Step 1 — the brief

In your pixel-lab folder, in Claude Code:

Watch what happens. It may need to install Node — a free tool that runs JavaScript outside the browser; it's the standard, say yes. It will ask permission before touching things; that's the permission system doing exactly its job, same as Course 02. And when it tells you what to paste into .env, go get your key from wherever you stashed it last lesson and paste it in yourself. That's the one piece of typing Claude Code shouldn't do for you, on principle: you handle the credit card.

Step 2 — first words through the wire

Start it: node server.js in a terminal. It prints that it's listening, then… sits there. That's not stuck. That's a server. It's a loop that answers, waiting for a question.

Now ask it one. You could learn curl — the terminal's way of poking a server — or you could do the Course-02 thing and make the tool do it:

Simulated run — your reply will differ. It's a language model; it has moods.

Sit with that JSON for a second. A program you own just had a conversation with a frontier AI model, through a socket you now have a key to. No chat window, no product, no middleman with a logo. This is the raw material every AI company is made of.

Step 3 — prove the key is invisible

Before anything gets committed, the professional move: verify git cannot see your key.

> git status

  modified:  .gitignore
  new file:  server.js

(no .env anywhere in this list — that's the win)

What you just did — secret in .env, fence in .gitignore, verify with git status — is the universal secrets ritual. Every deployment platform, every tutorial, every company codebase you'll ever see expects secrets in exactly this shape. You now do it by reflex.

What you just built (it isn't a toy)

Look at the three boxes in the diagram again. A frontend, a backend guarding credentials and shaping requests, a model behind an API. That's ChatGPT's website. That's every "AI-powered" feature in every SaaS product. That's the customer-support bot that annoyed you last week. The industry buzzword for what you did tonight is "integrating AI" — and when a company says it, a developer is being paid a lot of money to build the thing you just built before dinner.