Was your $HEROKU value plain, or encrypted? If it was plain and if it was working, it seems accidental; we would not have had access to $HEROKU value when configuring the build, and it was working because we passed through secure value without validation (it should be decrypted before it’s passed on to the next component in the system).
It stopped working because we are now doing more to ensure that configuration is correct and workable:
And your new configuration works, because it is valid. (I’d think that api_key: $HEROKU key-value pair should have worked, but I’m saying this from memory.)