Protect account access
Keep API keys on your server, not in browser code, URLs or screenshots. Use separate credentials where supported, redact logs and rotate exposed keys. Confirm which actions a key can perform.
Validate the catalog
Check service IDs, pricing units, minimum and maximum quantities and required fields. Recheck availability before placing orders rather than assuming a cached catalog stays valid.
Prevent accidental duplicate orders
Define what your application does after a timeout. Do not blindly retry an order-creation request when you do not know whether it succeeded. Ask whether the API supports idempotency or an order lookup reference.
Handle the whole lifecycle
Document pending, processing, partial, completed and canceled states where the provider supports them. Check rate limits, polling intervals and refill endpoints. Show uncertainty to users instead of labeling every API error as a failed order.
Test safely
Use a small authorized test and reconcile your application’s balance and status against the provider dashboard. Do not promise automatic synchronization until the integration is implemented and verified.