Best practices — before going live

Checklist

[ ] Sandbox integration tested end-to-end (orders, catalog, inventory)
[ ] Production API keys stored in a secrets manager (not git / chat)
[ ] Least-privilege scopes only
[ ] Webhook signature verification enabled and covered by tests
[ ] Timestamp / replay protection implemented
[ ] Idempotency keys on all creating POSTs
[ ] 429 handling with Retry-After + jitter
[ ] Cursor pagination — no unbounded list pulls
[ ] Structured logging with request_id (no secrets in logs)
[ ] Monitoring/alerts on error rate and webhook failure backlog
[ ] Runbook for key rotation and webhook endpoint change
[ ] Data Processing terms reviewed with counsel (GDPR)
[ ] Load/reconcile schedule respects rate limits

Production cutover

Freeze nonessential sandbox experiments
Create production keys + webhooks
Dual-run (sandbox mirror) if migrating from another platform
Switch writers (inventory SoR) in a maintenance window
Watch status page + your dashboards for 24–72 h

Anti-patterns to reject in code review

Disabling HMAC “temporarily”
Sharing one API key across many customers/tenants
Catch-all except: that retries forever
Writing inventory deltas from two systems without a SoR