Skip to main content
Before production traffic, verify each item below.

​
Credentials

  • Store project keys in a server-side secret manager.
  • Use separate test and live secrets.
  • Rotate keys by creating the replacement before revoking the old key.
  • Never log Authorization headers, request bodies, or metadata.

​
Request handling

  • Call QuotaMint from your backend.
  • Use consume as the authoritative decision.
  • Use a stable idempotency key for every billable operation.
  • Retry 500, 503, network ambiguity, and 429 with the original key and appropriate delay.
  • Treat denial reasons as normal product outcomes, not exceptional server failures.

​
Data isolation

Projects are the tenant boundary. Use one project per environment when balances must not mix. A public request can never choose a project or environment in its body; the API key establishes them.

​
Operational stop switches

A disabled project returns 403 project_disabled. Build a clear fallback path in your product and alert on repeated 503 responses: a disabled or unavailable runtime does not allow traffic.