Production checklist

Before enabling production traffic:

• configure the real deployment URL explicitly;
• store the API key in a secret manager;
• grant only the scopes the integration uses;
• verify HTTPS and the expected certificate chain;
• set request and connection timeouts based on your environment;
• keep automatic write retries disabled unless a reconciliation strategy exists;
• handle 401, 403, 404, 422, and 429 separately;
• use page size 200 only when response size and latency are acceptable;
• attach correlation IDs without overriding Authorization;
• sanitize logs and traces;
• monitor 429 and 5xx rates;
• persist returned resource IDs immediately after create operations;
• avoid concurrent reorder operations on the same workflow;
• test credential revocation;
• pin the OpenAPI contract used by your integration tests.