Production Readiness Checklist

Run this with the production key and configuration, not a mock. There is no published uptime commitment to cite, so the final step is a failure drill. Name an owner for the key, quota alert, and rollback first.

Access

• Store keys server-side, never in client bundles or git. Authentication
• Use one key per environment, with test keys outside production. Revocation clears within 5 minutes. Security
• Send Authorization: Bearer or x-api-key; never put a key in a query string. Authentication

Requests

• Set a timeout on every call, shorter than the caller’s own budget. Errors
• Retry only 429 and 5xx, honor Retry-After, and cap attempts. Retries
• Cache by base and date; cache past dates with a long TTL and keep the observation date. Caching
• Send dates as YYYY-MM-DD in UTC and read requestedDate and asOf. History coverage

Budget

• Alert on the monthly organization quota and the per-key minute limit separately. The minute limit counts errors and retries; the monthly quota counts successful billable requests. The API sends no quota headers, so measure from your side. Rate limits
• Map the gates: Free history is 30 days, analytics need Growth, AI credits are separate. Rate limits

Behavior

• Switch on error.code; 402 billing_past_due, 403 forbidden, and 429 rate_limited are different outcomes. Errors
• Log a correlation ID you generate, plus status, code, and latency. Never log the key; the API returns no request ID. Observability
• Set a maximum stale age per use and fail pricing paths closed. Graceful degradation
• Batch through /convert with up to 25 targets, or a paced pool for history. Bulk and concurrency

Go-live read

Exercise one success, then force 401, 403, 429, and a simulated 5xx. Confirm alerts fire, degraded responses are labeled, checkout refuses an expired snapshot, and rollback is config only.

Related

• API reference
• Authentication
• Errors
• Rate limits
• Guides
• Security
• Caching reference rates
• Observability