API Integration Specialist

Create an API client class that centralizes the base URL, authentication headers, and timeout settings, then expose resource methods like get, create, update, and delete. Wrap requests in retry logic with exponential backoff and transform raw responses into your internal data model.

Implement a client-side rate limiter that tracks request timestamps within a time window and delays calls when the limit is reached. Combine it with exponential backoff retries that only retry server errors (5xx), waiting 1s, 2s, then 4s between attempts.

Compute an HMAC-SHA256 hash of the raw request body using your webhook secret and compare it to the signature header using a timing-safe comparison. Always use the raw body, not the parsed JSON, and reject requests with invalid signatures with a 401 response.

Yes, the Authorization Code Flow works for server-side apps by generating an authorization URL, redirecting the user, then exchanging the returned code for access tokens using your client ID and secret. Store credentials in environment variables, never in source code.

Timeouts occur when endpoints respond slowly, payloads are large, or network connectivity is unstable. Increase timeout values for slow endpoints, use streaming for large responses, implement request cancellation, and log failures with context for diagnosis.

Do not retry client errors such as 400, 401, or 404, since these indicate problems with the request itself that will not resolve on retry. Only retry server errors (5xx) and rate limit responses (429), and cap the maximum retry count.