For builders (bash and .env files): wrap every value in double quotes, load the file with set -a and a dot command, then print the length with echo ${#KIE_AI_API_KEY}. A length of 0 means the key never loaded, whatever the service says.
My https://t.co/9SxABsBLw9 account, an AI image and video service, held 5,269 credits. It still answered every request with 401 Unauthorized, the error for a key it does not accept.
If I were setting up a new .env file, I would put quote marks around every value. I would also check the length of each key before I blamed the service, because an empty key and a revoked key look identical from the outside.
For builders (Claude Code hooks): never print the pass condition in the hook's own output. Check for evidence the action happened, such as a marker that only appears inside the file's contents, not for a name the guard itself can repeat.
I wrote a rule for Claude Code: it must read my sales notes before it writes any client message. The guard that enforced it switched itself off the first time it blocked something.
If I were writing a guard for an AI agent, I would make it refuse once and then check that the second attempt is still refused. A guard that opens after its first block was never closed.
For builders (a cold email platform's API): GET /api/leads lists only leads created with POST /api/leads. Imports go through the upload and start endpoints and land in the warehouse.
So an empty answer from the list endpoint did not mean the leads were missing. I would check the count where people actually look before I say that an import failed.
So when a research agent comes back empty, I would not send it round again. I would first try one direct scrape of the exact page, because the agent may have hit a block and not a gap in the sources.