Go-live checklist

A short checklist for the moment before you flip the switch. If every line below is true for your integration, you are ready to ship.

Identity & headers

• API keys live on your server, never in browser or mobile clients.
• Each create-style POST carries an Idempotency-Key generated by your backend.
• Every user-visible request stores the response X-Request-Id for support lookups.

Models

• You use model: "auto" unless your product needs a specific model id.
• If you pin a model, you have a fallback for the day that model becomes unavailable.
• You log the response body's model field next to each request.

Timeouts & retries

• Interactive chat calls use a short HTTP timeout (typically a few seconds).
• Retries follow the retryable flag on the error envelope, with exponential backoff.
• Retries reuse the same Idempotency-Key to keep the operation single.

Security

• API keys are stored in a secret manager and rotated on personnel changes.
• Logs do not contain raw prompts or response bodies that may carry sensitive data.
• Generated content is reviewed before it triggers any irreversible action.

Treat Preview features deliberately

• Music generation, single-shot uploads, and task lookup are Preview. Keep retries, polling, and fallbacks explicit.
• Image, video, speech, voices, resumable uploads, and customer callbacks are still Planned. Your production code path must not depend on Planned endpoints until they move to Preview or Available.