Go-live checklist

​

Before production

• Store live API keys in a secret manager. Do not place them in frontend code, source control or logs.
• Confirm that each endpoint is live or that your organisation has beta access. Preview endpoints are not available to production traffic.
• Confirm that the key’s endpoint-family scopes cover every model your integration calls.
• Keep test and live keys separate in each environment.

​

Request reliability

• Send a unique Idempotency-Key on every POST and reuse it only for retries of the same payload.
• Handle 202 as a normal accepted response. Poll the returned job or receive a webhook.
• Back off on 429 and honor Retry-After.
• Persist Request-Id and the job ID with your own request record.

​

Media and results

• Use presigned uploads for videos, batches and reusable media.
• Treat asset URLs and IDs as opaque values.
• Handle a successful empty result and low-confidence values in your application rules.

​

Validate

• Run your retry, failure and webhook tests with test mode.
• Verify webhook signatures and deduplicate by Carhub-Event-Id.
• Monitor failed and expired jobs, then retain the error code and request ID for support.