oss(da-cli): clarify api key usage (#3598)

Author: mdrxy

src/oss/deepagents/cli/configuration.mdx

@@ -106,7 +106,7 @@ Providers have the following configuration options:
 </ResponseField>
 
 <ResponseField name="api_key_env" type="string" post={["optional"]}>
-    Override the environment variable name checked for credentials. Most chat model packages read from a default env var automatically. See the [Provider reference](/oss/deepagents/cli/providers#provider-reference) table for which variable each provider checks.
+    The **name** of the environment variable that holds the API key (e.g., `"OPENAI_API_KEY"`), not the key itself. The CLI reads the credential from this env var at startup to verify access before creating the model. Most chat model packages read from a default env var automatically. See the [Provider reference](/oss/deepagents/cli/providers#provider-reference) table for which variable each provider checks.
 </ResponseField>
 
 <ResponseField name="base_url" type="string" post={["optional"]}>
@@ -115,6 +115,8 @@ Providers have the following configuration options:
 
 <ResponseField name="params" type="object" post={["optional"]}>
     Extra keyword arguments forwarded to the model constructor. Flat keys (e.g., `temperature = 0`) apply to every model from this provider. Model-keyed sub-tables (e.g., `[params."gpt-4o"]`) override individual values for that model only; the merge is shallow (model wins on conflict).
+
+    Do not put credentials (e.g., `api_key`) in `params`. Use [`api_key_env`](#provider-configuration) to point at an environment variable instead.
 </ResponseField>
 
 <ResponseField name="profile" type="object" post={["optional"]}>