Prepare for production

Use this review after the integration works in a non-production environment and before increasing traffic.

Security

• Keep each application and environment on a separate server-side key.
• Restrict diagnostic capture so authentication headers and response bodies do not enter analytics, traces, or error reports.
• Rotate deliberately and stop retrying an invalid or revoked key.
• Treat inventory data as user data and retain only what your product needs.

Reliability

Set explicit timeouts, retry only transient errors, add jitter, respect rate limits, and avoid synchronized refresh bursts.

Use one total workflow deadline, not a fresh unlimited budget for every attempt. Coordinate concurrency across workers and coalesce repeated reads where the product can tolerate cached data.

Application states

Verify that validation, authentication, privacy, rate limiting, insufficient credits, product unavailability, upstream failure, and unexpected failure do not collapse into one empty result. Drive decisions from the documented status and code, not message text.

Observability

Measure operation, status, duration, cache result, and request ID. Monitor the Status Page independently of API request handling.

Set alerts on your own error rate, latency, stale-data age, and exhausted retry budget. The Status Page adds context; it is not a substitute for observing your integration.

Release exercise

1. Run representative success and safe failure requests with a limited test key.
2. Confirm deadlines, retry caps, and rate-limit handling under concurrency.
3. Inspect logs, traces, analytics, screenshots, and browser storage for credential leakage.
4. Verify safe stale or unavailable behavior while the API is unreachable.
5. Record the rollback switch and on-call evidence required for support.

Finish with the Production checklist, Troubleshooting, and Support.