API Integration Specialist

Create a client class that wraps fetch with a base URL, authorization headers, and JSON content types. Add resource methods for GET, POST, PUT, and DELETE, then layer on retry logic and response transformation to map external fields to your internal model.

Wrap the request in a loop that catches errors, retries only server errors (status 500+), and waits 2^i seconds between attempts. Do not retry client errors like 401 or 400, and throw after the maximum retry count is reached.

Compute an HMAC-SHA256 of the raw request body using your webhook secret and compare it to the signature header with crypto.timingSafeEqual. Always use the raw body, not the parsed JSON, and reject requests with mismatched signatures.

Implement a client-side rate limiter that tracks request timestamps within a rolling window and delays new requests when the limit is reached. Combine this with backoff handling for 429 responses and batch endpoints when the API supports them.

Unauthorized errors usually come from expired tokens, missing scopes, or incorrect client credentials. Verify the token exchange succeeded, confirm the requested scopes match the API's requirements, and refresh tokens before they expire.