Production Integration Checklist
Validate authentication, retries, webhooks, quotas, observability, deletion, and operational ownership before launching Manifest AI API traffic.
A production-ready integration must protect credentials, preserve idempotency, bound retries, verify webhooks, monitor request IDs and quotas, and test terminal, duplicate, and deletion paths.
Before launch
Complete every control with evidence in a non-production workflow.
- Separate test and production credentials.
- Use least-privilege scopes and documented key ownership.
- Persist one Idempotency-Key per upstream business record.
- Set connect, upload, and response timeouts.
- Implement exponential backoff with jitter.
- Verify webhook signatures from raw bodies.
- Deduplicate webhook event IDs.
- Log X-Request-Id without logging secrets or document content.
- Alert on sustained 4xx, 5xx, and 429 rates.
- Test pause, cancel, failure, duplicate, expiry, and deletion behavior.
Operational ownership
Assign people and runbooks before traffic increases.
- Credential rotation owner.
- Webhook failure owner.
- Quota and credit monitoring owner.
- Customer-data deletion owner.
- Document-quality exception owner.
- Incident contact and rollback procedure.