fix(vapi): read SAMBANOVA_API_KEY from the environment

[AkhileshSamba]

Problem

vapi/app.py:15 hardcodes the API key and never reads the environment:

client = SambaNova(api_key="YOUR_SAMBANOVA_API_KEY")

The SambaNova docs page for this integration tells readers to export SAMBANOVA_API_KEY=..., so that export is a no-op and the documented flow cannot complete.

Reproduction

Clean clone, following the documented steps verbatim:

git clone https://github.com/sambanova/integrations.git && cd integrations/vapi
python -m venv .venv && source .venv/bin/activate
pip install "flask>=3.1,<4" "sambanova>=1.12,<2"
export SAMBANOVA_API_KEY="<a real key>"
python app.py
curl -X POST http://localhost:5000/chat/completions -H "Content-Type: application/json" \
  -d '{"model":"gpt-oss-120b","messages":[{"role":"user","content":"hi"}],"stream":false}'

Returns HTTP 500:

sambanova.AuthenticationError: Error code: 401 - Incorrect API key provided: YOUR_S*****_KEY

The API echoes the placeholder back, which confirms the exported variable is ignored. Because app.run(debug=True), the reader gets a full Werkzeug traceback page rather than a clean error.

The README already says "Use environment variables for secrets" under Notes and Best Practices. The code never did.

Fix

Read SAMBANOVA_API_KEY from the environment, and exit early with a message naming the problem, the fix, and where to get a key if it is missing.

Verified both paths:

Case	Before	After
var unset	starts, then 401s on the placeholder inside a debugger traceback	exits immediately: SAMBANOVA_API_KEY is not set. plus the export command and the portal link
var set	ignored, API sees YOUR_S*****_KEY	API sees the exported key

Tested with a deliberately invalid key to confirm the value reaches the API: the error changed from Incorrect API key provided: YOUR_S*****_KEY to Incorrect API key provided: sk-ups*****7722, my exported value.

Two other things I found but did not change here

Flagging rather than fixing, so this PR stays a one-file change. Happy to send either as a follow-up.

1. vapi/README.md gives the wrong Vapi endpoint URL. It says to paste https://abcd-1234.ngrok-free.dev/chat/completions into Vapi's endpoint field. Vapi's own docs say to paste the bare ngrok URL, because Vapi treats it as the OpenAI base URL and appends /chat/completions itself. Including the path yields /chat/completions/chat/completions and a 404. The SambaNova docs page was corrected for this; the README was not.

2. app.run(debug=True) combined with the documented ngrok tunnel is a real exposure. The 500 above returns source snippets, absolute filesystem paths, and a PIN-gated EVALEX console to anyone holding the public URL. The docs page now carries a warning about this, but a debug=os.environ.get("FLASK_DEBUG") == "1" default would be safer for anyone who copies this into something longer-lived.

🤖 Generated with Claude Code