API Integration Checklist

Build integrations that survive contact with production.

Checklist steps

  1. Read the docs and confirm scopes

    Least-privilege credentials only.

  2. Store credentials as secrets

    Never in code or client-side bundles.

  3. Handle rate limits and backoff

    Exponential backoff with jitter on 429 and 5xx.

  4. Make writes idempotent

    Use idempotency keys to survive retries.

  5. Validate and sanitise payloads

    Never trust upstream data shapes.

  6. Log requests without secrets

    Correlation IDs on every call.

  7. Add monitoring and alerts

    Failure rate, latency and quota usage.

  8. Test the sandbox and failure paths

    Timeouts, partial failures and revoked tokens.

Frequently asked questions

How long does this take?

Around 230 minutes end to end once the team knows the steps. Times per step are listed above.

Can I edit this checklist?

Yes. Save it to LemPlates and you can add, remove or reorder steps, assign owners and set due dates.

How often should this be run?

Run it every time the process happens and review the steps at least every six months.