Using other companies' APIs

Required

• Send the same idempotency key when you retry a write

  API-76

  Create one idempotency key for each business action, store it with the action, and send the same key on every retry of that write.

• Give each environment its own provider key

  API-80

  Use a separate key for each outside API in each environment, with only the permissions that environment needs. Only production holds a production key.

Recommended

• Wrap each outside API in one adapter

  API-75

  Put every call to one outside API in one module that speaks your own types. No other code imports its SDK or builds its addresses.

• Stay under their rate limits

  API-77

  Throttle your own calls below the provider's published limit. After a 429 or 503, send nothing more to that provider until its Retry-After time has passed.

• Decide what happens when a provider is down

  API-78

  For each call to an outside API, choose one of three paths for when it fails. Show a clear message, serve a saved answer, or queue the work and send it later.

• Pin their API version and watch for its end

  API-79

  Send the provider's API version on every call from one constant in the adapter. Log a warning whenever an answer carries a Deprecation or Sunset header.