Get startedProduction checklist
Validate security, reliability, and observability before launch.
- Keep API keys in a secret manager and rotate them deliberately.
- Set explicit connect and request timeouts.
- Retry only documented transient failures with jittered backoff.
- Respect rate-limit and cache metadata.
- Log
X-Request-ID, status, duration, and operation—not credentials or bodies.
- Handle private inventories and upstream Steam degradation as explicit states.
- Link operational alerts to the public Status Page.
- Validation and authentication failures stop without retrying unchanged input.
- Rate-limit handling coordinates all workers sharing a key.
- Private, empty, unavailable, and stale inventory states remain distinguishable.
- A partial paginated read never replaces a complete snapshot.
- Logs, traces, analytics, screenshots, and browser storage contain no credentials.
- Monitor success rate, latency, retry exhaustion, rate-limit rejection, and stale-data age.
- Retain operation, UTC timestamp, HTTP status, and request ID for diagnosis.
- Record how to disable traffic or roll back the integration.
- Keep Dashboard access and billing actions restricted to authorized operators.
Continue with Prepare for production.