Two things make or break an API integration: rate limits and webhooks. Get them wrong and your app breaks in production even though everything worked in testing.
Reading the headers
- ▸X-RateLimit-Limit — how many requests you get in the window
- ▸X-RateLimit-Remaining — how many you have left
- ▸X-RateLimit-Reset — when the window resets
- ▸Retry-After — how long to wait after a 429
Backoff that works
On a 429, wait the full Retry-After value. On a 5xx, retry with exponential backoff and jitter. Never retry a 4xx — your code is wrong, not our server.
Webhook delivery
Webhooks are delivered with an HMAC signature in the header. Verify it before trusting the payload. If your endpoint returns a non-2xx, we retry with backoff for 24 hours before dropping the event.
