update for best practices, add tokensecretname and capabilities

Author: sawka

docs/docs/waveai-modes.mdx

@@ -199,12 +199,12 @@ For newer models like GPT-4.1 or GPT-5, the API type is automatically determined
 
 ### OpenAI Compatible
 
-To use an OpenAPI compatible API provider, you need to provide the ai:endpoint, ai:apitoken, ai:model parameters,
-and use "openai-chat"  as the ai:mode.
+To use an OpenAPI compatible API provider, you need to provide the ai:endpoint, ai:apitokensecretname, ai:model parameters,
+and use "openai-chat" as the ai:apitype.
 
 :::note
 The ai:endpoint is *NOT* a baseurl. The endpoint should contain the full endpoint, not just the baseurl.
-For example: https://api.x.ai/v1/chat/completions 
+For example: https://api.x.ai/v1/chat/completions
 
 If you provide only the baseurl, you are likely to get a 404 message.
 :::
@@ -218,11 +218,14 @@ If you provide only the baseurl, you are likely to get a 404 message.
     "ai:apitype": "openai-chat",
     "ai:model": "x-ai/grok-4-fast",
     "ai:endpoint": "https://api.x.ai/v1/chat/completions",
-    "ai:apitoken": "<your-api-key>"
+    "ai:apitokensecretname": "XAI_KEY",
+    "ai:capabilities": ["tools", "images", "pdfs"]
   }
 }
 ```
 
+The `ai:apitokensecretname` should be the name of an environment variable that contains your API key. Set this environment variable before running Wave Terminal.
+
 
 ### OpenRouter