← All resources
Integration Checklist
API Integration Production Checklist
A successful API call is not a production integration. This checklist focuses on what tends to break after the happy-path demo works.
Last updated 2026-08-14
Contract and ownership
- ✓Document source-of-truth ownership for each field.
- ✓Define required vs optional data.
- ✓Version or isolate assumptions about third-party payloads.
Authentication
- ✓Use the appropriate OAuth/service-account pattern.
- ✓Handle refresh and expiry.
- ✓Store secrets securely and document credential ownership.
Webhook behavior
- ✓Verify signatures where supported.
- ✓Assume duplicate deliveries are possible.
- ✓Return acknowledgements quickly and process heavy work asynchronously where appropriate.
Rate limits and retries
- ✓Respect Retry-After and provider guidance.
- ✓Use bounded exponential backoff for transient errors.
- ✓Avoid retries for invalid requests that cannot succeed unchanged.
Validation and mapping
- ✓Validate external payloads before writing internal state.
- ✓Normalize dates, currencies, identifiers, and enums explicitly.
- ✓Log mapping failures without exposing sensitive payloads unnecessarily.
Observability and reconciliation
- ✓Use correlation/request identifiers.
- ✓Surface failed records and retry status.
- ✓Reconcile critical records between systems instead of assuming all writes arrived.
Need this applied to a real system?
I design and review AI automation, integrations, and operational systems with the same production-first approach.