Docs / Best practices
Best practices
1. Store keys in a secret manager
Never commit keys to git, bake them into containers, or log them. Use AWS Secrets Manager, GCP Secret Manager, Vault, or your platform's equivalent.
2. Use a separate key per environment
Production traffic must use a tfp_live_ key issued from a production portal. Local dev should use tfp_test_. Mixing the two causes stale-cache bugs that are hard to debug.
3. Retry with backoff, never with a tight loop
On 429 or 5xx, back off. Use the Retry-Afterheader when present. See rate limits.
4. Set a request timeout
Our SLA is 30 seconds. Set your client timeout to 35 seconds so a hung request fails before your queue backs up.
5. Use the SDK if you can
The official SDKs handle auth, retries, pagination, and typed errors. See TypeScript, Python, Go, Java, PHP, .NET.
6. Log requestId on every error
The requestId in the error envelope ties your client log to the server log. Without it, support cannot find your incident.