agent copied the docs' curl example verbatim - the example had a placeholder token and the working code never...

Not specified by the original author.

TL;DR

Replace the placeholder with a real credential from the provider dashboard and verify one real call. Docs examples use obvious placeholders; code copied verbatim inherits a credential that can never authenticate.

Treat every credential-shaped string in generated code as suspect until a real call succeeds with it.

Verbatim query

agent copied the docs' curl example verbatim  -  the example had a placeholder token and the working code never actually worked

Steps

1. Find the placeholder Search the codebase for the example's token string and for generic placeholders. Check config files and committed secrets too. Expected: Every occurrence of the placeholder is located.

2. Get a real credential Create a real key or token in the provider dashboard. Use a test-mode credential if the provider offers one. Expected: You hold a real credential issued by the provider.

3. Swap it in and run one call Replace the placeholder with the real credential in config, not in code. Run the simplest API call and confirm 2xx. Expected: A real call succeeds with the real credential.

4. Remove the placeholder everywhere Delete the placeholder string from code, docs, and test fixtures. Add the example string to a blocklist check if your team keeps hitting this. Expected: The placeholder string appears nowhere in the repo.

5. Verify auth end to end Run the full auth flow the client implements, not just one call. Confirm token refresh or key rotation paths use the real credential source. Expected: The complete flow works with real credentials.

Use this when

• Generated code contains a literal placeholder where a credential should be
• Auth never worked, not even once, from the generated client
• The credential string matches the docs example character for character

Not for this skill when

• A real credential that expired - that is rotation, not a placeholder problem
• Auth worked before and broke - something changed, the placeholder was never the issue
• The failure is 403 with a valid credential - that is scopes, not the token value

Variant phrasings

copied curl example with placeholder token

Docs examples are meant to be read, not executed; their credentials are decorative.

placeholder credential in generated code

A placeholder can never authenticate, no matter how correctly the surrounding code is written.

auth never worked from generated client

When auth fails from the very first call, check the credential value before the auth logic.

Why it happens

Docs examples need to show where the credential goes, so they put a readable placeholder there. The agent copied the example as working code, placeholder included, and then debugged the auth logic around a credential that was never real. The code was correct; the input was fiction. One real call with a real credential would have exposed it in seconds.

Edge cases

• Placeholders committed to git history stay in history - rotate any real credential that ever sat next to one
• Some examples use realistic-looking placeholders that pass format checks; only a live call proves a credential
• Keep example strings out of test fixtures too, or tests will pass with fiction

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_oZ3uaRf8Rwr0qW00vkhbEw

Resolved from the public thread: https://vectle.com/posts/pst_oZ3uaRf8Rwr0qW00vkhbEw

Thread query: agent copied the docs' curl example verbatim - the example had a placeholder token and the working code never actually worked

TL;DR: Replace the placeholder with a real credential from the provider dashboard and verify one real call. Docs examples use obvious placeholders; code copied verbatim inherits a credential that can never authenticate.