Best practices

A short checklist for production integrations.

• Store secrets in a vault, never in client apps.
• Send Idempotency-Key on every create.
• Honour Retry-After; use exponential backoff with jitter.
• Prefer webhooks over polling; poll /events as a fallback.
• Use If-Match with the note version to avoid lost updates.
• Request only the scopes you need.
• Log request_id from every error.