diff --git a/examples/eve-agent/README.md b/examples/eve-agent/README.md
index 856473b5..d94da805 100644
--- a/examples/eve-agent/README.md
+++ b/examples/eve-agent/README.md
@@ -17,6 +17,14 @@ This is an example [Vercel Eve](https://eve.vercel.com/) agent protected by
 simple agent that looks up orders, consults an API, receives inbound webhook
 messages, and records every guard decision with Arcjet.
 
+> [!WARNING]
+> This is a local demo, not a production authentication pattern. The
+> `/webhook` channel is unauthenticated so you can POST a message from curl or
+> a test client. `from(conversationId)` resolves that id to whichever session
+> currently owns it, so a hosted version must authenticate the caller before
+> `guardInbound` — otherwise anyone who can guess a conversation id can post
+> into it.
+
 ## Features
 
 - [AI guardrails](https://docs.arcjet.com/ai-guardrails) with the
diff --git a/examples/eve-agent/agent/arcjet.ts b/examples/eve-agent/agent/arcjet.ts
index 75ba5628..8804e078 100644
--- a/examples/eve-agent/agent/arcjet.ts
+++ b/examples/eve-agent/agent/arcjet.ts
@@ -1,9 +1,16 @@
 import { launchArcjet, tokenBucket } from "@arcjet/guard";
 
+const key = process.env.ARCJET_KEY;
+if (!key) {
+  throw new Error(
+    "ARCJET_KEY is required. Copy .env.local.example to .env.local and set it.",
+  );
+}
+
 // Create the Arcjet client once at module scope
 export const arcjet = launchArcjet({
   // Get your site key from https://console.arcjet.com
-  key: process.env.ARCJET_KEY ?? "",
+  key,
 });
 
 // Define rate limit rules at module scope
diff --git a/examples/firebase-functions/src/index.ts b/examples/firebase-functions/src/index.ts
index c5225ad7..985ec9ec 100644
--- a/examples/firebase-functions/src/index.ts
+++ b/examples/firebase-functions/src/index.ts
@@ -11,11 +11,11 @@ import * as logger from "firebase-functions/logger";
 
 setGlobalOptions({ maxInstances: 10, secrets: ["ARCJET_KEY"] });
 
-let arcjetKey = process.env.ARCJET_KEY;
+const arcjetKey = process.env.ARCJET_KEY;
 if (!arcjetKey) {
-  // In your app this should be a hard error! Here for the sake of the
-  // example we just use an intentionally invalid key.
-  arcjetKey = "";
+  throw new Error(
+    "ARCJET_KEY environment variable is required. Sign up for your Arcjet key at https://console.arcjet.com",
+  );
 }
 
 const arcjet = arcjetNode({
diff --git a/examples/nextjs-bot-categories/lib/arcjet.ts b/examples/nextjs-bot-categories/lib/arcjet.ts
index b6f295a9..636d6209 100644
--- a/examples/nextjs-bot-categories/lib/arcjet.ts
+++ b/examples/nextjs-bot-categories/lib/arcjet.ts
@@ -1,23 +1,11 @@
 import arcjetNextjs, { botCategories, detectBot } from "@arcjet/next";
 
-// Get your site key from https://console.arcjet.com
-// and set it as an environment variable rather than hard coding.
-// See: https://nextjs.org/docs/app/building-your-application/configuring/environment-variables
-let key = process.env.ARCJET_KEY;
-if (!key) {
-  // Normally we would throw an error here, but for the sake of the example
-  // application we will just log a warning and use a dummy key.
-
-  console.warn("Warning: ARCJET_KEY environment variable is not set.");
-  console.warn(
-    "Please set it to your Arcjet site key to enable bot protection.",
-  );
-  key = "arcjet_dummykey";
-}
-
 // Create a base Arcjet instance for use by each handler
 export const arcjet = arcjetNextjs({
-  key,
+  // Get your site key from https://console.arcjet.com
+  // and set it as an environment variable rather than hard coding.
+  // See: https://nextjs.org/docs/app/building-your-application/configuring/environment-variables
+  key: process.env.ARCJET_KEY!,
   rules: [
     // Detect bots with fine-grained control over which are allowed. This shows
     // three ways to build the allow list: by category, by individual bot, and
diff --git a/examples/nextjs-bot-protection/lib/arcjet.ts b/examples/nextjs-bot-protection/lib/arcjet.ts
index c541cfb4..3631c654 100644
--- a/examples/nextjs-bot-protection/lib/arcjet.ts
+++ b/examples/nextjs-bot-protection/lib/arcjet.ts
@@ -1,23 +1,11 @@
 import arcjetNextjs, { detectBot } from "@arcjet/next";
 
-// Get your site key from https://console.arcjet.com
-// and set it as an environment variable rather than hard coding.
-// See: https://nextjs.org/docs/app/building-your-application/configuring/environment-variables
-let key = process.env.ARCJET_KEY;
-if (!key) {
-  // Normally we would throw an error here, but for the sake of the example
-  // application we will just log a warning and use a dummy key.
-
-  console.warn("Warning: ARCJET_KEY environment variable is not set.");
-  console.warn(
-    "Please set it to your Arcjet site key to enable bot protection.",
-  );
-  key = "arcjet_dummykey";
-}
-
 // Create a base Arcjet instance for use by each handler
 export const arcjet = arcjetNextjs({
-  key,
+  // Get your site key from https://console.arcjet.com
+  // and set it as an environment variable rather than hard coding.
+  // See: https://nextjs.org/docs/app/building-your-application/configuring/environment-variables
+  key: process.env.ARCJET_KEY!,
   rules: [
     detectBot({
       mode: "LIVE", // will block requests. Use "DRY_RUN" to log only
diff --git a/examples/nextjs-form/app/submit/route.ts b/examples/nextjs-form/app/submit/route.ts
index 22a4a873..c225042f 100644
--- a/examples/nextjs-form/app/submit/route.ts
+++ b/examples/nextjs-form/app/submit/route.ts
@@ -1,6 +1,25 @@
 import { type NextRequest, NextResponse } from "next/server";
 import { formSchema } from "@/app/schema";
-import arcjet from "@/lib/arcjet";
+import arcjet, { detectBot, shield, slidingWindow } from "@/lib/arcjet";
+
+const aj = arcjet
+  // Shield protects your app from common attacks e.g. SQL injection
+  .withRule(shield({ mode: "LIVE" }))
+  // Block automated clients from submitting the form
+  .withRule(
+    detectBot({
+      mode: "LIVE", // will block requests. Use "DRY_RUN" to log only
+      allow: [], // Block all bots. See https://arcjet.com/bot-list
+    }),
+  )
+  // Limit how often a single IP can submit the form
+  .withRule(
+    slidingWindow({
+      mode: "LIVE",
+      interval: "10m",
+      max: 5,
+    }),
+  );
 
 export async function POST(req: NextRequest) {
   const json = await req.json();
@@ -17,7 +36,7 @@ export async function POST(req: NextRequest) {
 
   // The protect method returns a decision object that contains information
   // about the request.
-  const decision = await arcjet.protect(req);
+  const decision = await aj.protect(req);
 
   console.log("Arcjet decision: ", decision);
 
diff --git a/examples/nextjs-server-action/app/actions.ts b/examples/nextjs-server-action/app/actions.ts
index 5f5e787a..1fad1c93 100644
--- a/examples/nextjs-server-action/app/actions.ts
+++ b/examples/nextjs-server-action/app/actions.ts
@@ -8,20 +8,11 @@ import arcjet, {
 } from "@arcjet/next";
 import { redirect } from "next/navigation";
 
-// Get your site key from https://console.arcjet.com
-// and set it as an environment variable rather than hard coding.
-// See: https://nextjs.org/docs/app/building-your-application/configuring/environment-variables
-let key = process.env.ARCJET_KEY;
-if (!key) {
-  // Normally we would throw an error here, but for the sake of the example
-  // application we will just log a warning and use a dummy key.
-  console.warn("Warning: ARCJET_KEY environment variable is not set.");
-  key = "arcjet_dummykey";
-}
-
 const aj = arcjet({
   // Get your site key from https://console.arcjet.com
-  key,
+  // and set it as an environment variable rather than hard coding.
+  // See: https://nextjs.org/docs/app/building-your-application/configuring/environment-variables
+  key: process.env.ARCJET_KEY!,
   rules: [
     // Shield protects your app from common attacks e.g. SQL injection
     shield({ mode: "LIVE" }),
diff --git a/examples/nuxt/Dockerfile b/examples/nuxt/Dockerfile
index a01caa38..070c64b5 100644
--- a/examples/nuxt/Dockerfile
+++ b/examples/nuxt/Dockerfile
@@ -9,11 +9,9 @@ RUN npm ci
 
 COPY . .
 
-# Note: Nuxt requires `ARCJET_KEY` to be set during build. Here we set it to a
-#       dummy value if not set to allow builds to succeed.
-ENV ARCJET_KEY=${ARCJET_KEY:-ajkey_dummy}
-
-# NOTE: Have to run postinstall as it handles automatic import resolution
-RUN npm run postinstall && npm run build
+# Nuxt requires `ARCJET_KEY` at build time. Keep the placeholder on this RUN
+# only — do not persist it as a runtime ENV or the image ships a dummy key.
+ARG ARCJET_KEY=ajkey_yourkey
+RUN ARCJET_KEY=$ARCJET_KEY npm run postinstall && npm run build
 
 CMD ["npm", "run", "start"]
\ No newline at end of file