Skip to main content

Integration rules

  • Isolate each provider behind a service/client module; do not call third-party APIs from unrelated route handlers.
  • Keep provider credentials in AWS Secrets or the approved secret mechanism.
  • Make webhooks authenticated, idempotent, observable, and safe to retry.
  • Record provider request IDs and internal correlation IDs in structured logs/traces.
  • Document ownership, failure mode, retry policy, rate limits, and data classification for each new integration.