Skip to content

Add placeholder API_KEY value with a guard check to both sample scripts - #11

Merged
3 commits merged into
mainfrom
doc-271-add-api-key-and-file-path-guard-check
Aug 24, 2026
Merged

Add placeholder API_KEY value with a guard check to both sample scripts#11
3 commits merged into
mainfrom
doc-271-add-api-key-and-file-path-guard-check

Conversation

@monica-unstructured

@monica-unstructured monica-unstructured commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

Supersedes #10, which closed unexpectedly when its branch was renamed. Same commit, same content, just carried over to the renamed branch.

Summary

Follow-up to PR #9, which added extract_quickstart.py and partition_quickstart.py with API_KEY = "" as the placeholder.

  • Renames both scripts to hyphenated filenames (extract-quickstart.py, partition-quickstart.py) so users don't need to hold Shift to type an underscore when running them.

  • Running either script without the user correctly setting API_KEY fails with an authentication error partway through the run.

    • Replaces the empty-string placeholder with API_KEY = "YOUR_API_KEY_HERE" and adds a guard check that exits immediately with a clear message if that placeholder (or an empty string) is still in place, instead of failing with a confusing API error later in the script.
    • Extends the same placeholder-value guard check to INPUT_DIR and OUTPUT_DIR, so leaving either at its default path fails immediately with a clear message instead of a confusing OS-level error partway through the script.
    • Moves all three checks into a validate_inputs() function defined before the editable settings, so the settings a user actually needs to change read as one uninterrupted block.

Update 2026-08-24: this PR now also includes a follow-up commit that restores the /api/v1 suffix on API_URL in both scripts, now that unstructured-client 0.46.2 fixes the URL-doubling bug for transform.unstructured.io that this suffix used to trigger. Verified locally against the live API after upgrading to 0.46.2: the /api/v1-suffixed server_url now builds a correct request URL instead of doubling the path. Matches the corresponding fix in docs PR #1090.

Test plan

  • python3 -m py_compile on both scripts
  • Ran both scripts with the placeholder key in place; confirmed each exits immediately with the guard message
  • Confirmed against the live API that an empty string and the literal placeholder string both produce a genuine 401 authentication error, matching the commit message's claim

🤖 Generated with Claude Code

Running either script without the user correctly setting the API_KEY variable
fails with an authentication error. We added a check that displays a
user-friendly message if the script detects the default placeholder value,
"YOUR_API_KEY_HERE", instead of proceeding and failing with a confusing API
error partway through.

Matches the same change already applied to the embedded copies of these
scripts in docs PR #1090 (commit 4ed81e1d).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1 issue found across 2 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="transform/sample-code/extract_quickstart.py">

<violation number="1" location="transform/sample-code/extract_quickstart.py:14">
P3: A key pasted with leading or trailing whitespace (common when copying from an editor or `.env` file) bypasses this guard, since the comparison is verbatim, and is sent unchanged to `UnstructuredClient`, producing the same late, confusing 401 this guard is meant to prevent. Normalize the key with `strip()` before the check so whitespace-padded placeholder/empty values are caught too.</violation>
</file>

Shadow auto-approve: would not auto-approve because issues were found.

Re-trigger cubic

@@ -11,7 +11,9 @@
# This isn't best practice outside of local testing on your own machine. Once
# you've added your real key, don't share this file or check it into any
# repositories.
API_KEY = ""
API_KEY = "YOUR_API_KEY_HERE"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P3: A key pasted with leading or trailing whitespace (common when copying from an editor or .env file) bypasses this guard, since the comparison is verbatim, and is sent unchanged to UnstructuredClient, producing the same late, confusing 401 this guard is meant to prevent. Normalize the key with strip() before the check so whitespace-padded placeholder/empty values are caught too.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At transform/sample-code/extract_quickstart.py, line 14:

<comment>A key pasted with leading or trailing whitespace (common when copying from an editor or `.env` file) bypasses this guard, since the comparison is verbatim, and is sent unchanged to `UnstructuredClient`, producing the same late, confusing 401 this guard is meant to prevent. Normalize the key with `strip()` before the check so whitespace-padded placeholder/empty values are caught too.</comment>

<file context>
@@ -11,7 +11,9 @@
 # you've added your real key, don't share this file or check it into any
 # repositories.
-API_KEY = ""
+API_KEY = "YOUR_API_KEY_HERE"
+if API_KEY in ("YOUR_API_KEY_HERE", ""):
+    raise SystemExit("Set API_KEY to your Unstructured API key before running this script.")
</file context>
Suggested change
API_KEY = "YOUR_API_KEY_HERE"
API_KEY = "YOUR_API_KEY_HERE"
API_KEY = API_KEY.strip()
if API_KEY in ("YOUR_API_KEY_HERE", ""):
raise SystemExit("Set API_KEY to your Unstructured API key before running this script.")

…IR guards

- Rename extract_quickstart.py to extract-quickstart.py and
  partition_quickstart.py to partition-quickstart.py, so users don't need to
  hold Shift to type an underscore when running either script.
- Add the same placeholder-value guard check already applied to API_KEY to
  INPUT_DIR and OUTPUT_DIR, so leaving either at its default path fails
  immediately with a clear message instead of a confusing OS-level error
  partway through the script.
- Move all three checks into a validate_inputs() function defined before the
  editable settings, so the settings a user actually needs to change read as
  one uninterrupted block instead of being interleaved with validation logic.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

0 issues found across 2 files (changes from recent commits).

Shadow auto-approve: would not auto-approve. Auto-approval blocked by 1 unresolved issue from previous reviews.

Re-trigger cubic

- Move the previously-uncommitted validate_inputs() refactor in: replaces
  the three inline guard checks with one function, called after the
  editable settings, so that block reads as one uninterrupted unit.
- Restore the /api/v1 suffix on API_URL now that unstructured-client
  0.46.2 fixes the doubling bug in clean_server_url_hook.py for
  transform.unstructured.io. This matches the value the Transform app's
  Copy button gives you, so curl and Python samples use the same URL.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

0 issues found across 2 files (changes from recent commits).

Shadow auto-approve: would not auto-approve. Auto-approval blocked by 1 unresolved issue from previous reviews.

Re-trigger cubic

@ghost
ghost merged commit a7f4134 into main Aug 24, 2026
4 checks passed
@ghost
ghost deleted the doc-271-add-api-key-and-file-path-guard-check branch August 24, 2026 17:00
This pull request was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant