Production checklist

API keys live on your servers only, loaded from environment variables or a secret manager, never in client code.

Each environment (production, staging, CI) has its own key, with the smallest set of scopes it needs.

Keys used from fixed servers carry an IP allowlist.

You know how to rotate a key without downtime.

Every create request sends an Idempotency-Key derived from your own job id, and retries reuse it with the identical body.

You retry 429 and 503 after Retry-After, 500 and network errors with backoff, and never retry other 4xx errors.

You store the task id as soon as the create call returns.

metadata carries your own ids (order, user, job) so webhook handlers can route events without a lookup.

Input files are served over public HTTPS from storage that answers HEAD, and presigned URLs stay valid for at least an hour.

A webhook endpoint (default or per task) receives events in production; polling is only a fallback, with backoff.

The webhook handler verifies the signature over the raw body, rejects old timestamps, and de-duplicates on webhook-id.

The handler answers 2xx within 10 seconds and processes the event asynchronously.

You download output.video.url to your own storage on task.completed, well before expires_at (7 days).

A periodic job reconciles tasks that are still open on your side by calling GET /v1/tasks/{task_id}.

You handle failed tasks by error.code, and resubmit only when error.retryable is true, with a new idempotency key.

Your own queue keeps queued + processing tasks below plan.max_concurrent_tasks.

You watch X-RateLimit-Remaining and slow down before it reaches zero.

You cancel tasks whose results you no longer need, which frees the slot and the credits at once.

A low-balance reminder is set on the Billing page, so a top-up happens before tasks start failing with 402.

You log the X-Request-Id of every failed request, and include it when you contact support.

You track your spend with GET /v1/account/usage or the console’s usage page.