Resources

Best Practices

Use these practices to build a secure and resilient Otonum integration.

Security

• Keep API keys server-side only
• Store secrets in environment variables or a secure vault
• Rotate keys periodically and after suspected compromise
• Never commit secrets to source control

Transport and Access

• Use HTTPS for all requests
• Route API calls through backend services, not client applications
• Scope keys by integration when practical

Rate Limiting and Retries

Otonum enforces request limits per API key.

• Implement exponential backoff on 429 responses
• Add bounded retry logic for transient server errors
• Avoid aggressive retry loops that can amplify failures

Error Handling

• Check HTTP status codes on every response
• Parse and log returned error codes and messages
• Treat duplicate purchase references as idempotency signals, not generic failures

Idempotency

Use stable, unique reference values for activities so retries cannot duplicate reward processing.

Environment Strategy

• Develop and validate in 🧪 Sandbox first
• Move to 🚀 Production only after functional and failure-path testing

Operational Readiness

• Capture request identifiers and task IDs in logs
• Monitor error rates and rate-limit events
• Provide support with task IDs and relevant error payloads when escalation is needed

See Also

• Error Codes: Expected failures and actions
• Task Status: Async processing lifecycle
• Authentication: Key management fundamentals